Repository: kubernetes-sigs/gateway-api

Issue:
Conformance test HTTPRouteWeight is Failing
<!--
Thank you for your interest in Gateway API! Please note that bug reports
here should only be used for bugs with the API itself, such as:

- Incomplete or inaccurate validation
- Problems with the API specification
- Flaws in conformance tests

Bugs that don't fit into one of the above categories should likely be filed
with the [implementation](https://gateway-api.sigs.k8s.io/implementations/)
of Gateway API that you're using.

Please use this template while reporting a bug and provide as much info as
possible. Not doing so may result in your bug not being addressed in a timely
manner. Thank you!
-->

**What happened**:

As HTTPRouteWeight test is Failing in https://github.com/nginx/nginx-gateway-fabric/issues/3797.

**What you expected to happen**:

HTTPRouteWeight test pass.

**How to reproduce it (as minimally and precisely as possible)**:

https://github.com/nginx/nginx-gateway-fabric/actions/runs/17256977734/job/48971158299

**Anything else we need to know?**:


As `http.Response.StatusCode` is Deprecated in https://github.com/kubernetes-sigs/gateway-api/pull/4010 and although there is a workaround at https://github.com/kubernetes-sigs/gateway-api/blob/d28cd59d37887be07b879f098cff7b14a87c0080/conformance/utils/http/http.go#L144-L147

But in HTTPRouteWeight Test we call `http.CompareRoundTrip()` directlly
https://github.com/kubernetes-sigs/gateway-api/blob/d28cd59d37887be07b879f098cff7b14a87c0080/conformance/tests/httproute-weight.go#L112-L114


Discussion:
@LiorLieberman: /cc 
/cc @snorwin@snorwin: @fabian4 thanks for reporting and sorry for the inconveniences. It’s really appreciated that the NGINX project is essentially integration testing our conformance suite.

Solution patch:
diff --git a/apis/v1/gateway_types.go b/apis/v1/gateway_types.go
index e85e81ba..652101ff 100644
--- a/apis/v1/gateway_types.go
+++ b/apis/v1/gateway_types.go
@@ -279,15 +279,6 @@ type GatewaySpec struct {
 	// +optional
 	Infrastructure *GatewayInfrastructure `json:"infrastructure,omitempty"`
 
-	// BackendTLS configures TLS settings for when this Gateway is connecting to
-	// backends with TLS.
-	//
-	// Support: Core
-	//
-	// +optional
-	// <gateway:experimental>
-	BackendTLS *GatewayBackendTLS `json:"backendTLS,omitempty"`
-
 	// AllowedListeners defines which ListenerSets can be attached to this Gateway.
 	// While this feature is experimental, the default value is to allow no ListenerSets.
 	//
@@ -296,7 +287,7 @@ type GatewaySpec struct {
 	// +optional
 	AllowedListeners *AllowedListeners `json:"allowedListeners,omitempty"`
 	//
-	// GatewayTLSConfig specifies frontend tls configuration for gateway.
+	// TLS specifies frontend and backend tls configuration for entire gateway.
 	//
 	// Support: Extended
 	//
@@ -525,8 +516,6 @@ type GatewayBackendTLS struct {
 	// ClientCertificateRef can reference to standard Kubernetes resources, i.e.
 	// Secret, or implementation-specific custom resources.
 	//
-	// This setting can be overridden on the service level by use of BackendTLSPolicy.
-	//
 	// Support: Core
 	//
 	// +optional
@@ -602,8 +591,31 @@ type ListenerTLSConfig struct {
 	Options map[AnnotationKey]AnnotationValue `json:"options,omitempty"`
 }
 
-// GatewayTLSConfig specifies frontend tls configuration for gateway.
+// GatewayTLSConfig specifies frontend and backend tls configuration for gateway.
 type GatewayTLSConfig struct {
+	// Backend describes TLS configuration for gateway when connecting
+	// to backends.
+	//
+	// Note that this contains only details for the Gateway as a TLS client,
+	// and does _not_ imply behavior about how to choose which backend should
+	// get a TLS connection. That is determined by the presence of a BackendTLSPolicy.
+	//
+	// Support: Core
+	//
+	// +optional
+	// <gateway:experimental>
+	Backend *GatewayBackendTLS `json:"backend,omitempty"`
+
+	// Frontend describes TLS config when client connects to Gateway.
+	// Support: Core
+	//
+	// +optional
+	// <gateway:experimental>
+	Frontend *FrontendTLSConfig `json:"frontend,omitempty"`
+}
+
+// FrontendTLSConfig specifies frontend tls configuration for gateway.
+type FrontendTLSConfig struct {
 	// Default specifies the default client certificate validation configuration
 	// for all Listeners handling HTTPS traffic, unless a per-port configuration
 	// is defined.
@@ -653,7 +665,7 @@ const (
 // within this Gateway. Currently, it stores only the client certificate validation
 // configuration, but this may be extended in the future.
 type TLSConfig struct {
-	// FrontendValidation holds configuration information for validating the frontend (client).
+	// Validation holds configuration information for validating the frontend (client).
 	// Setting this field will result in mutual authentication when connecting to the gateway.
 	// In browsers this may result in a dialog appearing
 	// that requests a user to specify the client certificate.
@@ -661,9 +673,9 @@ type TLSConfig struct {
 	//
 	// Support: Core
 	//
-	// +required
+	// +optional
 	// <gateway:experimental>
-	FrontendValidation FrontendTLSValidation `json:"frontendValidation"`
+	Validation *FrontendTLSValidation `json:"validation,omitempty"`
 }
 
 type TLSPortConfig struct {
diff --git a/apis/v1/zz_generated.deepcopy.go b/apis/v1/zz_generated.deepcopy.go
index 6bbf75ba..bcbf4890 100644
--- a/apis/v1/zz_generated.deepcopy.go
+++ b/apis/v1/zz_generated.deepcopy.go
@@ -205,6 +205,29 @@ func (in *Fraction) DeepCopy() *Fraction {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *FrontendTLSConfig) DeepCopyInto(out *FrontendTLSConfig) {
+	*out = *in
+	in.Default.DeepCopyInto(&out.Default)
+	if in.PerPort != nil {
+		in, out := &in.PerPort, &out.PerPort
+		*out = make([]TLSPortConfig, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new FrontendTLSConfig.
+func (in *FrontendTLSConfig) DeepCopy() *FrontendTLSConfig {
+	if in == nil {
+		return nil
+	}
+	out := new(FrontendTLSConfig)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *FrontendTLSValidation) DeepCopyInto(out *FrontendTLSValidation) {
 	*out = *in
@@ -777,11 +800,6 @@ func (in *GatewaySpec) DeepCopyInto(out *GatewaySpec) {
 		*out = new(GatewayInfrastructure)
 		(*in).DeepCopyInto(*out)
 	}
-	if in.BackendTLS != nil {
-		in, out := &in.BackendTLS, &out.BackendTLS
-		*out = new(GatewayBackendTLS)
-		(*in).DeepCopyInto(*out)
-	}
 	if in.AllowedListeners != nil {
 		in, out := &in.AllowedListeners, &out.AllowedListeners
 		*out = new(AllowedListeners)
@@ -883,13 +901,15 @@ func (in *GatewayStatusAddress) DeepCopy() *GatewayStatusAddress {
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *GatewayTLSConfig) DeepCopyInto(out *GatewayTLSConfig) {
 	*out = *in
-	in.Default.DeepCopyInto(&out.Default)
-	if in.PerPort != nil {
-		in, out := &in.PerPort, &out.PerPort
-		*out = make([]TLSPortConfig, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
+	if in.Backend != nil {
+		in, out := &in.Backend, &out.Backend
+		*out = new(GatewayBackendTLS)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Frontend != nil {
+		in, out := &in.Frontend, &out.Frontend
+		*out = new(FrontendTLSConfig)
+		(*in).DeepCopyInto(*out)
 	}
 }
 
@@ -1962,7 +1982,11 @@ func (in *SupportedFeature) DeepCopy() *SupportedFeature {
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *TLSConfig) DeepCopyInto(out *TLSConfig) {
 	*out = *in
-	in.FrontendValidation.DeepCopyInto(&out.FrontendValidation)
+	if in.Validation != nil {
+		in, out := &in.Validation, &out.Validation
+		*out = new(FrontendTLSValidation)
+		(*in).DeepCopyInto(*out)
+	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TLSConfig.
diff --git a/applyconfiguration/apis/v1/frontendtlsconfig.go b/applyconfiguration/apis/v1/frontendtlsconfig.go
new file mode 100644
index 00000000..4cf84649
--- /dev/null
+++ b/applyconfiguration/apis/v1/frontendtlsconfig.go
@@ -0,0 +1,53 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1
+
+// FrontendTLSConfigApplyConfiguration represents a declarative configuration of the FrontendTLSConfig type for use
+// with apply.
+type FrontendTLSConfigApplyConfiguration struct {
+	Default *TLSConfigApplyConfiguration      `json:"default,omitempty"`
+	PerPort []TLSPortConfigApplyConfiguration `json:"perPort,omitempty"`
+}
+
+// FrontendTLSConfigApplyConfiguration constructs a declarative configuration of the FrontendTLSConfig type for use with
+// apply.
+func FrontendTLSConfig() *FrontendTLSConfigApplyConfiguration {
+	return &FrontendTLSConfigApplyConfiguration{}
+}
+
+// WithDefault sets the Default field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Default field is set to the value of the last call.
+func (b *FrontendTLSConfigApplyConfiguration) WithDefault(value *TLSConfigApplyConfiguration) *FrontendTLSConfigApplyConfiguration {
+	b.Default = value
+	return b
+}
+
+// WithPerPort adds the given value to the PerPort field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the PerPort field.
+func (b *FrontendTLSConfigApplyConfiguration) WithPerPort(values ...*TLSPortConfigApplyConfiguration) *FrontendTLSConfigApplyConfiguration {
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithPerPort")
+		}
+		b.PerPort = append(b.PerPort, *values[i])
+	}
+	return b
+}
diff --git a/applyconfiguration/apis/v1/gatewayspec.go b/applyconfiguration/apis/v1/gatewayspec.go
index b123a40f..e976dc48 100644
--- a/applyconfiguration/apis/v1/gatewayspec.go
+++ b/applyconfiguration/apis/v1/gatewayspec.go
@@ -29,7 +29,6 @@ type GatewaySpecApplyConfiguration struct {
 	Listeners        []ListenerApplyConfiguration             `json:"listeners,omitempty"`
 	Addresses        []GatewaySpecAddressApplyConfiguration   `json:"addresses,omitempty"`
 	Infrastructure   *GatewayInfrastructureApplyConfiguration `json:"infrastructure,omitempty"`
-	BackendTLS       *GatewayBackendTLSApplyConfiguration     `json:"backendTLS,omitempty"`
 	AllowedListeners *AllowedListenersApplyConfiguration      `json:"allowedListeners,omitempty"`
 	TLS              *GatewayTLSConfigApplyConfiguration      `json:"tls,omitempty"`
 }
@@ -82,14 +81,6 @@ func (b *GatewaySpecApplyConfiguration) WithInfrastructure(value *GatewayInfrast
 	return b
 }
 
-// WithBackendTLS sets the BackendTLS field in the declarative configuration to the given value
-// and returns the receiver, so that objects can be built by chaining "With" function invocations.
-// If called multiple times, the BackendTLS field is set to the value of the last call.
-func (b *GatewaySpecApplyConfiguration) WithBackendTLS(value *GatewayBackendTLSApplyConfiguration) *GatewaySpecApplyConfiguration {
-	b.BackendTLS = value
-	return b
-}
-
 // WithAllowedListeners sets the AllowedListeners field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
 // If called multiple times, the AllowedListeners field is set to the value of the last call.
diff --git a/applyconfiguration/apis/v1/gatewaytlsconfig.go b/applyconfiguration/apis/v1/gatewaytlsconfig.go
index dbd3f443..4ec825db 100644
--- a/applyconfiguration/apis/v1/gatewaytlsconfig.go
+++ b/applyconfiguration/apis/v1/gatewaytlsconfig.go
@@ -21,8 +21,8 @@ package v1
 // GatewayTLSConfigApplyConfiguration represents a declarative configuration of the GatewayTLSConfig type for use
 // with apply.
 type GatewayTLSConfigApplyConfiguration struct {
-	Default *TLSConfigApplyConfiguration      `json:"default,omitempty"`
-	PerPort []TLSPortConfigApplyConfiguration `json:"perPort,omitempty"`
+	Backend  *GatewayBackendTLSApplyConfiguration `json:"backend,omitempty"`
+	Frontend *FrontendTLSConfigApplyConfiguration `json:"frontend,omitempty"`
 }
 
 // GatewayTLSConfigApplyConfiguration constructs a declarative configuration of the GatewayTLSConfig type for use with
@@ -31,23 +31,18 @@ func GatewayTLSConfig() *GatewayTLSConfigApplyConfiguration {
 	return &GatewayTLSConfigApplyConfiguration{}
 }
 
-// WithDefault sets the Default field in the declarative configuration to the given value
+// WithBackend sets the Backend field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
-// If called multiple times, the Default field is set to the value of the last call.
-func (b *GatewayTLSConfigApplyConfiguration) WithDefault(value *TLSConfigApplyConfiguration) *GatewayTLSConfigApplyConfiguration {
-	b.Default = value
+// If called multiple times, the Backend field is set to the value of the last call.
+func (b *GatewayTLSConfigApplyConfiguration) WithBackend(value *GatewayBackendTLSApplyConfiguration) *GatewayTLSConfigApplyConfiguration {
+	b.Backend = value
 	return b
 }
 
-// WithPerPort adds the given value to the PerPort field in the declarative configuration
-// and returns the receiver, so that objects can be build by chaining "With" function invocations.
-// If called multiple times, values provided by each call will be appended to the PerPort field.
-func (b *GatewayTLSConfigApplyConfiguration) WithPerPort(values ...*TLSPortConfigApplyConfiguration) *GatewayTLSConfigApplyConfiguration {
-	for i := range values {
-		if values[i] == nil {
-			panic("nil value passed to WithPerPort")
-		}
-		b.PerPort = append(b.PerPort, *values[i])
-	}
+// WithFrontend sets the Frontend field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Frontend field is set to the value of the last call.
+func (b *GatewayTLSConfigApplyConfiguration) WithFrontend(value *FrontendTLSConfigApplyConfiguration) *GatewayTLSConfigApplyConfiguration {
+	b.Frontend = value
 	return b
 }
diff --git a/applyconfiguration/apis/v1/tlsconfig.go b/applyconfiguration/apis/v1/tlsconfig.go
index 1dfa5e02..99a42ca4 100644
--- a/applyconfiguration/apis/v1/tlsconfig.go
+++ b/applyconfiguration/apis/v1/tlsconfig.go
@@ -21,7 +21,7 @@ package v1
 // TLSConfigApplyConfiguration represents a declarative configuration of the TLSConfig type for use
 // with apply.
 type TLSConfigApplyConfiguration struct {
-	FrontendValidation *FrontendTLSValidationApplyConfiguration `json:"frontendValidation,omitempty"`
+	Validation *FrontendTLSValidationApplyConfiguration `json:"validation,omitempty"`
 }
 
 // TLSConfigApplyConfiguration constructs a declarative configuration of the TLSConfig type for use with
@@ -30,10 +30,10 @@ func TLSConfig() *TLSConfigApplyConfiguration {
 	return &TLSConfigApplyConfiguration{}
 }
 
-// WithFrontendValidation sets the FrontendValidation field in the declarative configuration to the given value
+// WithValidation sets the Validation field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
-// If called multiple times, the FrontendValidation field is set to the value of the last call.
-func (b *TLSConfigApplyConfiguration) WithFrontendValidation(value *FrontendTLSValidationApplyConfiguration) *TLSConfigApplyConfiguration {
-	b.FrontendValidation = value
+// If called multiple times, the Validation field is set to the value of the last call.
+func (b *TLSConfigApplyConfiguration) WithValidation(value *FrontendTLSValidationApplyConfiguration) *TLSConfigApplyConfiguration {
+	b.Validation = value
 	return b
 }
diff --git a/applyconfiguration/internal/internal.go b/applyconfiguration/internal/internal.go
index 953f2863..974c4bd2 100644
--- a/applyconfiguration/internal/internal.go
+++ b/applyconfiguration/internal/internal.go
@@ -304,6 +304,21 @@ var schemaYAML = typed.YAMLObject(`types:
       type:
         scalar: numeric
       default: 0
+- name: io.k8s.sigs.gateway-api.apis.v1.FrontendTLSConfig
+  map:
+    fields:
+    - name: default
+      type:
+        namedType: io.k8s.sigs.gateway-api.apis.v1.TLSConfig
+      default: {}
+    - name: perPort
+      type:
+        list:
+          elementType:
+            namedType: io.k8s.sigs.gateway-api.apis.v1.TLSPortConfig
+          elementRelationship: associative
+          keys:
+          - port
 - name: io.k8s.sigs.gateway-api.apis.v1.FrontendTLSValidation
   map:
     fields:
@@ -598,9 +613,6 @@ var schemaYAML = typed.YAMLObject(`types:
     - name: allowedListeners
       type:
         namedType: io.k8s.sigs.gateway-api.apis.v1.AllowedListeners
-    - name: backendTLS
-      type:
-        namedType: io.k8s.sigs.gateway-api.apis.v1.GatewayBackendTLS
     - name: gatewayClassName
       type:
         scalar: string
@@ -666,18 +678,12 @@ var schemaYAML = typed.YAMLObject(`types:
 - name: io.k8s.sigs.gateway-api.apis.v1.GatewayTLSConfig
   map:
     fields:
-    - name: default
+    - name: backend
       type:
-        namedType: io.k8s.sigs.gateway-api.apis.v1.TLSConfig
-      default: {}
-    - name: perPort
+        namedType: io.k8s.sigs.gateway-api.apis.v1.GatewayBackendTLS
+    - name: frontend
       type:
-        list:
-          elementType:
-            namedType: io.k8s.sigs.gateway-api.apis.v1.TLSPortConfig
-          elementRelationship: associative
-          keys:
-          - port
+        namedType: io.k8s.sigs.gateway-api.apis.v1.FrontendTLSConfig
 - name: io.k8s.sigs.gateway-api.apis.v1.HTTPAuthConfig
   map:
     fields:
@@ -1311,10 +1317,9 @@ var schemaYAML = typed.YAMLObject(`types:
 - name: io.k8s.sigs.gateway-api.apis.v1.TLSConfig
   map:
     fields:
-    - name: frontendValidation
+    - name: validation
       type:
         namedType: io.k8s.sigs.gateway-api.apis.v1.FrontendTLSValidation
-      default: {}
 - name: io.k8s.sigs.gateway-api.apis.v1.TLSPortConfig
   map:
     fields:
diff --git a/applyconfiguration/utils.go b/applyconfiguration/utils.go
index 5acafbc2..274736cd 100644
--- a/applyconfiguration/utils.go
+++ b/applyconfiguration/utils.go
@@ -56,6 +56,8 @@ func ForKind(kind schema.GroupVersionKind) interface{} {
 		return &apisv1.ForwardBodyConfigApplyConfiguration{}
 	case v1.SchemeGroupVersion.WithKind("Fraction"):
 		return &apisv1.FractionApplyConfiguration{}
+	case v1.SchemeGroupVersion.WithKind("FrontendTLSConfig"):
+		return &apisv1.FrontendTLSConfigApplyConfiguration{}
 	case v1.SchemeGroupVersion.WithKind("FrontendTLSValidation"):
 		return &apisv1.FrontendTLSValidationApplyConfiguration{}
 	case v1.SchemeGroupVersion.WithKind("Gateway"):
diff --git a/config/crd/experimental/gateway.networking.k8s.io_gateways.yaml b/config/crd/experimental/gateway.networking.k8s.io_gateways.yaml
index f04f7b97..6e154e95 100644
--- a/config/crd/experimental/gateway.networking.k8s.io_gateways.yaml
+++ b/config/crd/experimental/gateway.networking.k8s.io_gateways.yaml
@@ -215,70 +215,6 @@ spec:
                         x-kubernetes-map-type: atomic
                     type: object
                 type: object
-              backendTLS:
-                description: |-
-                  BackendTLS configures TLS settings for when this Gateway is connecting to
-                  backends with TLS.
-
-                  Support: Core
-                properties:
-                  clientCertificateRef:
-                    description: |-
-                      ClientCertificateRef is a reference to an object that contains a Client
-                      Certificate and the associated private key.
-
-                      References to a resource in different namespace are invalid UNLESS there
-                      is a ReferenceGrant in the target namespace that allows the certificate
-                      to be attached. If a ReferenceGrant does not allow this reference, the
-                      "ResolvedRefs" condition MUST be set to False for this listener with the
-                      "RefNotPermitted" reason.
-
-                      ClientCertificateRef can reference to standard Kubernetes resources, i.e.
-                      Secret, or implementation-specific custom resources.
-
-                      This setting can be overridden on the service level by use of BackendTLSPolicy.
-
-                      Support: Core
-                    properties:
-                      group:
-                        default: ""
-                        description: |-
-                          Group is the group of the referent. For example, "gateway.networking.k8s.io".
-                          When unspecified or empty string, core API group is inferred.
-                        maxLength: 253
-                        pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
-                        type: string
-                      kind:
-                        default: Secret
-                        description: Kind is kind of the referent. For example "Secret".
-                        maxLength: 63
-                        minLength: 1
-                        pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
-                        type: string
-                      name:
-                        description: Name is the name of the referent.
-                        maxLength: 253
-                        minLength: 1
-                        type: string
-                      namespace:
-                        description: |-
-                          Namespace is the namespace of the referenced object. When unspecified, the local
-                          namespace is inferred.
-
-                          Note that when a namespace different than the local namespace is specified,
-                          a ReferenceGrant object is required in the referent namespace to allow that
-                          namespace's owner to accept the reference. See the ReferenceGrant
-                          documentation for details.
-
-                          Support: Core
-                        maxLength: 63
-                        minLength: 1
-                        pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
-                        type: string
-                    required:
-                    - name
-                    type: object
-                type: object
               gatewayClassName:
                 description: |-
                   GatewayClassName used for this Gateway. This is the name of a
@@ -970,294 +906,363 @@ spec:
                     == l2.hostname : !has(l1.hostname) && !has(l2.hostname))))'
               tls:
                 description: |-
-                  GatewayTLSConfig specifies frontend tls configuration for gateway.
+                  TLS specifies frontend and backend tls configuration for entire gateway.
 
                   Support: Extended
                 properties:
-                  default:
+                  backend:
                     description: |-
-                      Default specifies the default client certificate validation configuration
-                      for all Listeners handling HTTPS traffic, unless a per-port configuration
-                      is defined.
+                      Backend describes TLS configuration for gateway when connecting
+                      to backends.
 
-                      support: Core
+                      Note that this contains only details for the Gateway as a TLS client,
+                      and does _not_ imply behavior about how to choose which backend should
+                      get a TLS connection. That is determined by the presence of a BackendTLSPolicy.
+
+                      Support: Core
                     properties:
-                      frontendValidation:
+                      clientCertificateRef:
                         description: |-
-                          FrontendValidation holds configuration information for validating the frontend (client).
-                          Setting this field will result in mutual authentication when connecting to the gateway.
-                          In browsers this may result in a dialog appearing
-                          that requests a user to specify the client certificate.
-                          The maximum depth of a certificate chain accepted in verification is Implementation specific.
+                          ClientCertificateRef is a reference to an object that contains a Client
+                          Certificate and the associated private key.
+
+                          References to a resource in different namespace are invalid UNLESS there
+                          is a ReferenceGrant in the target namespace that allows the certificate
+                          to be attached. If a ReferenceGrant does not allow this reference, the
+                          "ResolvedRefs" condition MUST be set to False for this listener with the
+                          "RefNotPermitted" reason.
+
+                          ClientCertificateRef can reference to standard Kubernetes resources, i.e.
+                          Secret, or implementation-specific custom resources.
 
                           Support: Core
                         properties:
-                          caCertificateRefs:
+                          group:
+                            default: ""
                             description: |-
-                              CACertificateRefs contains one or more references to
-                              Kubernetes objects that contain TLS certificates of
-                              the Certificate Authorities that can be used
-                              as a trust anchor to validate the certificates presented by the client.
-
-                              A single CA certificate reference to a Kubernetes ConfigMap
-                              has "Core" support.
-                              Implementations MAY choose to support attaching multiple CA certificates to
-                              a Listener, but this behavior is implementation-specific.
-
-                              Support: Core - A single reference to a Kubernetes ConfigMap
-                              with the CA certificate in a key named `ca.crt`.
-
-                              Support: Implementation-specific (More than one certificate in a ConfigMap
-                              with different keys or more than one reference, or other kinds of resources).
-
-                              References to a resource in a different namespace are invalid UNLESS there
-                              is a ReferenceGrant in the target namespace that allows the certificate
-                              to be attached. If a ReferenceGrant does not allow this reference, the
-                              "ResolvedRefs" condition MUST be set to False for this listener with the
-                              "RefNotPermitted" reason.
-                            items:
-                              description: |-
-                                ObjectReference identifies an API object including its namespace.
-
-                                The API object must be valid in the cluster; the Group and Kind must
-                                be registered in the cluster for this reference to be valid.
-
-                                References to objects with invalid Group and Kind are not valid, and must
-                                be rejected by the implementation, with appropriate Conditions set
-                                on the containing object.
-                              properties:
-                                group:
-                                  description: |-
-                                    Group is the group of the referent. For example, "gateway.networking.k8s.io".
-                                    When set to the empty string, core API group is inferred.
-                                  maxLength: 253
-                                  pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
-                                  type: string
-                                kind:
-                                  description: Kind is kind of the referent. For example
-                                    "ConfigMap" or "Service".
-                                  maxLength: 63
-                                  minLength: 1
-                                  pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
-                                  type: string
-                                name:
-                                  description: Name is the name of the referent.
-                                  maxLength: 253
-                                  minLength: 1
-                                  type: string
-                                namespace:
-                                  description: |-
-                                    Namespace is the namespace of the referenced object. When unspecified, the local
-                                    namespace is inferred.
-
-                                    Note that when a namespace different than the local namespace is specified,
-                                    a ReferenceGrant object is required in the referent namespace to allow that
-                                    namespace's owner to accept the reference. See the ReferenceGrant
-                                    documentation for details.
-
-                                    Support: Core
-                                  maxLength: 63
-                                  minLength: 1
-                                  pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
-                                  type: string
-                              required:
-                              - group
-                              - kind
-                              - name
-                              type: object
-                            maxItems: 8
-                            minItems: 1
-                            type: array
-                            x-kubernetes-list-type: atomic
-                          mode:
-                            default: AllowValidOnly
+                              Group is the group of the referent. For example, "gateway.networking.k8s.io".
+                              When unspecified or empty string, core API group is inferred.
+                            maxLength: 253
+                            pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                            type: string
+                          kind:
+                            default: Secret
+                            description: Kind is kind of the referent. For example
+                              "Secret".
+                            maxLength: 63
+                            minLength: 1
+                            pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                            type: string
+                          name:
+                            description: Name is the name of the referent.
+                            maxLength: 253
+                            minLength: 1
+                            type: string
+                          namespace:
                             description: |-
-                              FrontendValidationMode defines the mode for validating the client certificate.
-                              There are two possible modes:
-
-                              - AllowValidOnly: In this mode, the gateway will accept connections only if
-                                the client presents a valid certificate. This certificate must successfully
-                                pass validation against the CA certificates specified in `CACertificateRefs`.
-                              - AllowInsecureFallback: In this mode, the gateway will accept connections
-                                even if the client certificate is not presented or fails verification.
+                              Namespace is the namespace of the referenced object. When unspecified, the local
+                              namespace is inferred.
 
-                                This approach delegates client authorization to the backend and introduce
-                                a significant security risk. It should be used in testing environments or
-                                on a temporary basis in non-testing environments.
-
-                              Defaults to AllowValidOnly.
+                              Note that when a namespace different than the local namespace is specified,
+                              a ReferenceGrant object is required in the referent namespace to allow that
+                              namespace's owner to accept the reference. See the ReferenceGrant
+                              documentation for details.
 
                               Support: Core
-                            enum:
-                            - AllowValidOnly
-                            - AllowInsecureFallback
+                            maxLength: 63
+                            minLength: 1
+                            pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
                             type: string
                         required:
-                        - caCertificateRefs
+                        - name
                         type: object
-                    required:
-                    - frontendValidation
                     type: object
-                  perPort:
+                  frontend:
                     description: |-
-                      PerPort specifies tls configuration assigned per port.
-                      Per port configuration is optional. Once set this configuration overrides
-                      the default configuration for all Listeners handling HTTPS traffic
-                      that match this port.
-                      Each override port requires a unique TLS configuration.
-
-                      support: Core
-                    items:
-                      properties:
-                        port:
-                          description: |-
-                            The Port indicates the Port Number to which the TLS configuration will be
-                            applied. This configuration will be applied to all Listeners handling HTTPS
-                            traffic that match this port.
-
-                            Support: Core
-                          format: int32
-                          maximum: 65535
-                          minimum: 1
-                          type: integer
-                        tls:
-                          description: |-
-                            TLS store the configuration that will be applied to all Listeners handling
-                            HTTPS traffic and matching given port.
+                      Frontend describes TLS config when client connects to Gateway.
+                      Support: Core
+                    properties:
+                      default:
+                        description: |-
+                          Default specifies the default client certificate validation configuration
+                          for all Listeners handling HTTPS traffic, unless a per-port configuration
+                          is defined.
 
-                            Support: Core
-                          properties:
-                            frontendValidation:
-                              description: |-
-                                FrontendValidation holds configuration information for validating the frontend (client).
-                                Setting this field will result in mutual authentication when connecting to the gateway.
-                                In browsers this may result in a dialog appearing
-                                that requests a user to specify the client certificate.
-                                The maximum depth of a certificate chain accepted in verification is Implementation specific.
+                          support: Core
+                        properties:
+                          validation:
+                            description: |-
+                              Validation holds configuration information for validating the frontend (client).
+                              Setting this field will result in mutual authentication when connecting to the gateway.
+                              In browsers this may result in a dialog appearing
+                              that requests a user to specify the client certificate.
+                              The maximum depth of a certificate chain accepted in verification is Implementation specific.
 
-                                Support: Core
-                              properties:
-                                caCertificateRefs:
+                              Support: Core
+                            properties:
+                              caCertificateRefs:
+                                description: |-
+                                  CACertificateRefs contains one or more references to
+                                  Kubernetes objects that contain TLS certificates of
+                                  the Certificate Authorities that can be used
+                                  as a trust anchor to validate the certificates presented by the client.
+
+                                  A single CA certificate reference to a Kubernetes ConfigMap
+                                  has "Core" support.
+                                  Implementations MAY choose to support attaching multiple CA certificates to
+                                  a Listener, but this behavior is implementation-specific.
+
+                                  Support: Core - A single reference to a Kubernetes ConfigMap
+                                  with the CA certificate in a key named `ca.crt`.
+
+                                  Support: Implementation-specific (More than one certificate in a ConfigMap
+                                  with different keys or more than one reference, or other kinds of resources).
+
+                                  References to a resource in a different namespace are invalid UNLESS there
+                                  is a ReferenceGrant in the target namespace that allows the certificate
+                                  to be attached. If a ReferenceGrant does not allow this reference, the
+                                  "ResolvedRefs" condition MUST be set to False for this listener with the
+                                  "RefNotPermitted" reason.
+                                items:
                                   description: |-
-                                    CACertificateRefs contains one or more references to
-                                    Kubernetes objects that contain TLS certificates of
-                                    the Certificate Authorities that can be used
-                                    as a trust anchor to validate the certificates presented by the client.
-
-                                    A single CA certificate reference to a Kubernetes ConfigMap
-                                    has "Core" support.
-                                    Implementations MAY choose to support attaching multiple CA certificates to
-                                    a Listener, but this behavior is implementation-specific.
-
-                                    Support: Core - A single reference to a Kubernetes ConfigMap
-                                    with the CA certificate in a key named `ca.crt`.
-
-                                    Support: Implementation-specific (More than one certificate in a ConfigMap
-                                    with different keys or more than one reference, or other kinds of resources).
-
-                                    References to a resource in a different namespace are invalid UNLESS there
-                                    is a ReferenceGrant in the target namespace that allows the certificate
-                                    to be attached. If a ReferenceGrant does not allow this reference, the
-                                    "ResolvedRefs" condition MUST be set to False for this listener with the
-                                    "RefNotPermitted" reason.
-                                  items:
-                                    description: |-
-                                      ObjectReference identifies an API object including its namespace.
+                                    ObjectReference identifies an API object including its namespace.
+
+                                    The API object must be valid in the cluster; the Group and Kind must
+                                    be registered in the cluster for this reference to be valid.
+
+                                    References to objects with invalid Group and Kind are not valid, and must
+                                    be rejected by the implementation, with appropriate Conditions set
+                                    on the containing object.
+                                  properties:
+                                    group:
+                                      description: |-
+                                        Group is the group of the referent. For example, "gateway.networking.k8s.io".
+                                        When set to the empty string, core API group is inferred.
+                                      maxLength: 253
+                                      pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                      type: string
+                                    kind:
+                                      description: Kind is kind of the referent. For
+                                        example "ConfigMap" or "Service".
+                                      maxLength: 63
+                                      minLength: 1
+                                      pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                                      type: string
+                                    name:
+                                      description: Name is the name of the referent.
+                                      maxLength: 253
+                                      minLength: 1
+                                      type: string
+                                    namespace:
+                                      description: |-
+                                        Namespace is the namespace of the referenced object. When unspecified, the local
+                                        namespace is inferred.
+
+                                        Note that when a namespace different than the local namespace is specified,
+                                        a ReferenceGrant object is required in the referent namespace to allow that
+                                        namespace's owner to accept the reference. See the ReferenceGrant
+                                        documentation for details.
+
+                                        Support: Core
+                                      maxLength: 63
+                                      minLength: 1
+                                      pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+                                      type: string
+                                  required:
+                                  - group
+                                  - kind
+                                  - name
+                                  type: object
+                                maxItems: 8
+                                minItems: 1
+                                type: array
+                                x-kubernetes-list-type: atomic
+                              mode:
+                                default: AllowValidOnly
+                                description: |-
+                                  FrontendValidationMode defines the mode for validating the client certificate.
+                                  There are two possible modes:
 
-                                      The API object must be valid in the cluster; the Group and Kind must
-                                      be registered in the cluster for this reference to be valid.
+                                  - AllowValidOnly: In this mode, the gateway will accept connections only if
+                                    the client presents a valid certificate. This certificate must successfully
+                                    pass validation against the CA certificates specified in `CACertificateRefs`.
+                                  - AllowInsecureFallback: In this mode, the gateway will accept connections
+                                    even if the client certificate is not presented or fails verification.
 
-                                      References to objects with invalid Group and Kind are not valid, and must
-                                      be rejected by the implementation, with appropriate Conditions set
-                                      on the containing object.
-                                    properties:
-                                      group:
-                                        description: |-
-                                          Group is the group of the referent. For example, "gateway.networking.k8s.io".
-                                          When set to the empty string, core API group is inferred.
-                                        maxLength: 253
-                                        pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
-                                        type: string
-                                      kind:
-                                        description: Kind is kind of the referent.
-                                          For example "ConfigMap" or "Service".
-                                        maxLength: 63
-                                        minLength: 1
-                                        pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
-                                        type: string
-                                      name:
-                                        description: Name is the name of the referent.
-                                        maxLength: 253
-                                        minLength: 1
-                                        type: string
-                                      namespace:
-                                        description: |-
-                                          Namespace is the namespace of the referenced object. When unspecified, the local
-                                          namespace is inferred.
-
-                                          Note that when a namespace different than the local namespace is specified,
-                                          a ReferenceGrant object is required in the referent namespace to allow that
-                                          namespace's owner to accept the reference. See the ReferenceGrant
-                                          documentation for details.
-
-                                          Support: Core
-                                        maxLength: 63
-                                        minLength: 1
-                                        pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
-                                        type: string
-                                    required:
-                                    - group
-                                    - kind
-                                    - name
-                                    type: object
-                                  maxItems: 8
-                                  minItems: 1
-                                  type: array
-                                  x-kubernetes-list-type: atomic
-                                mode:
-                                  default: AllowValidOnly
-                                  description: |-
-                                    FrontendValidationMode defines the mode for validating the client certificate.
-                                    There are two possible modes:
+                                    This approach delegates client authorization to the backend and introduce
+                                    a significant security risk. It should be used in testing environments or
+                                    on a temporary basis in non-testing environments.
 
-                                    - AllowValidOnly: In this mode, the gateway will accept connections only if
-                                      the client presents a valid certificate. This certificate must successfully
-                                      pass validation against the CA certificates specified in `CACertificateRefs`.
-                                    - AllowInsecureFallback: In this mode, the gateway will accept connections
-                                      even if the client certificate is not presented or fails verification.
+                                  Defaults to AllowValidOnly.
 
-                                      This approach delegates client authorization to the backend and introduce
-                                      a significant security risk. It should be used in testing environments or
-                                      on a temporary basis in non-testing environments.
+                                  Support: Core
+                                enum:
+                                - AllowValidOnly
+                                - AllowInsecureFallback
+                                type: string
+                            required:
+                            - caCertificateRefs
+                            type: object
+                        type: object
+                      perPort:
+                        description: |-
+                          PerPort specifies tls configuration assigned per port.
+                          Per port configuration is optional. Once set this configuration overrides
+                          the default configuration for all Listeners handling HTTPS traffic
+                          that match this port.
+                          Each override port requires a unique TLS configuration.
+
+                          support: Core
+                        items:
+                          properties:
+                            port:
+                              description: |-
+                                The Port indicates the Port Number to which the TLS configuration will be
+                                applied. This configuration will be applied to all Listeners handling HTTPS
+                                traffic that match this port.
+
+                                Support: Core
+                              format: int32
+                              maximum: 65535
+                              minimum: 1
+                              type: integer
+                            tls:
+                              description: |-
+                                TLS store the configuration that will be applied to all Listeners handling
+                                HTTPS traffic and matching given port.
 
-                                    Defaults to AllowValidOnly.
+                                Support: Core
+                              properties:
+                                validation:
+                                  description: |-
+                                    Validation holds configuration information for validating the frontend (client).
+                                    Setting this field will result in mutual authentication when connecting to the gateway.
+                                    In browsers this may result in a dialog appearing
+                                    that requests a user to specify the client certificate.
+                                    The maximum depth of a certificate chain accepted in verification is Implementation specific.
 
                                     Support: Core
-                                  enum:
-                                  - AllowValidOnly
-                                  - AllowInsecureFallback
-                                  type: string
-                              required:
-                              - caCertificateRefs
+                                  properties:
+                                    caCertificateRefs:
+                                      description: |-
+                                        CACertificateRefs contains one or more references to
+                                        Kubernetes objects that contain TLS certificates of
+                                        the Certificate Authorities that can be used
+                                        as a trust anchor to validate the certificates presented by the client.
+
+                                        A single CA certificate reference to a Kubernetes ConfigMap
+                                        has "Core" support.
+                                        Implementations MAY choose to support attaching multiple CA certificates to
+                                        a Listener, but this behavior is implementation-specific.
+
+                                        Support: Core - A single reference to a Kubernetes ConfigMap
+                                        with the CA certificate in a key named `ca.crt`.
+
+                                        Support: Implementation-specific (More than one certificate in a ConfigMap
+                                        with different keys or more than one reference, or other kinds of resources).
+
+                                        References to a resource in a different namespace are invalid UNLESS there
+                                        is a ReferenceGrant in the target namespace that allows the certificate
+                                        to be attached. If a ReferenceGrant does not allow this reference, the
+                                        "ResolvedRefs" condition MUST be set to False for this listener with the
+                                        "RefNotPermitted" reason.
+                                      items:
+                                        description: |-
+                                          ObjectReference identifies an API object including its namespace.
+
+                                          The API object must be valid in the cluster; the Group and Kind must
+                                          be registered in the cluster for this reference to be valid.
+
+                                          References to objects with invalid Group and Kind are not valid, and must
+                                          be rejected by the implementation, with appropriate Conditions set
+                                          on the containing object.
+                                        properties:
+                                          group:
+                                            description: |-
+                                              Group is the group of the referent. For example, "gateway.networking.k8s.io".
+                                              When set to the empty string, core API group is inferred.
+                                            maxLength: 253
+                                            pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                            type: string
+                                          kind:
+                                            description: Kind is kind of the referent.
+                                              For example "ConfigMap" or "Service".
+                                            maxLength: 63
+                                            minLength: 1
+                                            pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                                            type: string
+                                          name:
+                                            description: Name is the name of the referent.
+                                            maxLength: 253
+                                            minLength: 1
+                                            type: string
+                                          namespace:
+                                            description: |-
+                                              Namespace is the namespace of the referenced object. When unspecified, the local
+                                              namespace is inferred.
+
+                                              Note that when a namespace different than the local namespace is specified,
+                                              a ReferenceGrant object is required in the referent namespace to allow that
+                                              namespace's owner to accept the reference. See the ReferenceGrant
+                                              documentation for details.
+
+                                              Support: Core
+                                            maxLength: 63
+                                            minLength: 1
+                                            pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+                                            type: string
+                                        required:
+                                        - group
+                                        - kind
+                                        - name
+                                        type: object
+                                      maxItems: 8
+                                      minItems: 1
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    mode:
+                                      default: AllowValidOnly
+                                      description: |-
+                                        FrontendValidationMode defines the mode for validating the client certificate.
+                                        There are two possible modes:
+
+                                        - AllowValidOnly: In this mode, the gateway will accept connections only if
+                                          the client presents a valid certificate. This certificate must successfully
+                                          pass validation against the CA certificates specified in `CACertificateRefs`.
+                                        - AllowInsecureFallback: In this mode, the gateway will accept connections
+                                          even if the client certificate is not presented or fails verification.
+
+                                          This approach delegates client authorization to the backend and introduce
+                                          a significant security risk. It should be used in testing environments or
+                                          on a temporary basis in non-testing environments.
+
+                                        Defaults to AllowValidOnly.
+
+                                        Support: Core
+                                      enum:
+                                      - AllowValidOnly
+                                      - AllowInsecureFallback
+                                      type: string
+                                  required:
+                                  - caCertificateRefs
+                                  type: object
                               type: object
                           required:
-                          - frontendValidation
+                          - port
+                          - tls
                           type: object
-                      required:
-                      - port
-                      - tls
-                      type: object
-                    maxItems: 64
-                    type: array
-                    x-kubernetes-list-map-keys:
-                    - port
-                    x-kubernetes-list-type: map
-                    x-kubernetes-validations:
-                    - message: Port for TLS configuration must be unique within the
-                        Gateway
-                      rule: self.all(t1, self.exists_one(t2, t1.port == t2.port))
-                required:
-                - default
+                        maxItems: 64
+                        type: array
+                        x-kubernetes-list-map-keys:
+                        - port
+                        x-kubernetes-list-type: map
+                        x-kubernetes-validations:
+                        - message: Port for TLS configuration must be unique within
+                            the Gateway
+                          rule: self.all(t1, self.exists_one(t2, t1.port == t2.port))
+                    required:
+                    - default
+                    type: object
                 type: object
             required:
             - gatewayClassName
@@ -1762,70 +1767,6 @@ spec:
                         x-kubernetes-map-type: atomic
                     type: object
                 type: object
-              backendTLS:
-                description: |-
-                  BackendTLS configures TLS settings for when this Gateway is connecting to
-                  backends with TLS.
-
-                  Support: Core
-                properties:
-                  clientCertificateRef:
-                    description: |-
-                      ClientCertificateRef is a reference to an object that contains a Client
-                      Certificate and the associated private key.
-
-                      References to a resource in different namespace are invalid UNLESS there
-                      is a ReferenceGrant in the target namespace that allows the certificate
-                      to be attached. If a ReferenceGrant does not allow this reference, the
-                      "ResolvedRefs" condition MUST be set to False for this listener with the
-                      "RefNotPermitted" reason.
-
-                      ClientCertificateRef can reference to standard Kubernetes resources, i.e.
-                      Secret, or implementation-specific custom resources.
-
-                      This setting can be overridden on the service level by use of BackendTLSPolicy.
-
-                      Support: Core
-                    properties:
-                      group:
-                        default: ""
-                        description: |-
-                          Group is the group of the referent. For example, "gateway.networking.k8s.io".
-                          When unspecified or empty string, core API group is inferred.
-                        maxLength: 253
-                        pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
-                        type: string
-                      kind:
-                        default: Secret
-                        description: Kind is kind of the referent. For example "Secret".
-                        maxLength: 63
-                        minLength: 1
-                        pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
-                        type: string
-                      name:
-                        description: Name is the name of the referent.
-                        maxLength: 253
-                        minLength: 1
-                        type: string
-                      namespace:
-                        description: |-
-                          Namespace is the namespace of the referenced object. When unspecified, the local
-                          namespace is inferred.
-
-                          Note that when a namespace different than the local namespace is specified,
-                          a ReferenceGrant object is required in the referent namespace to allow that
-                          namespace's owner to accept the reference. See the ReferenceGrant
-                          documentation for details.
-
-                          Support: Core
-                        maxLength: 63
-                        minLength: 1
-                        pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
-                        type: string
-                    required:
-                    - name
-                    type: object
-                type: object
               gatewayClassName:
                 description: |-
                   GatewayClassName used for this Gateway. This is the name of a
@@ -2517,294 +2458,363 @@ spec:
                     == l2.hostname : !has(l1.hostname) && !has(l2.hostname))))'
               tls:
                 description: |-
-                  GatewayTLSConfig specifies frontend tls configuration for gateway.
+                  TLS specifies frontend and backend tls configuration for entire gateway.
 
                   Support: Extended
                 properties:
-                  default:
+                  backend:
                     description: |-
-                      Default specifies the default client certificate validation configuration
-                      for all Listeners handling HTTPS traffic, unless a per-port configuration
-                      is defined.
+                      Backend describes TLS configuration for gateway when connecting
+                      to backends.
 
-                      support: Core
+                      Note that this contains only details for the Gateway as a TLS client,
+                      and does _not_ imply behavior about how to choose which backend should
+                      get a TLS connection. That is determined by the presence of a BackendTLSPolicy.
+
+                      Support: Core
                     properties:
-                      frontendValidation:
+                      clientCertificateRef:
                         description: |-
-                          FrontendValidation holds configuration information for validating the frontend (client).
-                          Setting this field will result in mutual authentication when connecting to the gateway.
-                          In browsers this may result in a dialog appearing
-                          that requests a user to specify the client certificate.
-                          The maximum depth of a certificate chain accepted in verification is Implementation specific.
+                          ClientCertificateRef is a reference to an object that contains a Client
+                          Certificate and the associated private key.
+
+                          References to a resource in different namespace are invalid UNLESS there
+                          is a ReferenceGrant in the target namespace that allows the certificate
+                          to be attached. If a ReferenceGrant does not allow this reference, the
+                          "ResolvedRefs" condition MUST be set to False for this listener with the
+                          "RefNotPermitted" reason.
+
+                          ClientCertificateRef can reference to standard Kubernetes resources, i.e.
+                          Secret, or implementation-specific custom resources.
 
                           Support: Core
                         properties:
-                          caCertificateRefs:
+                          group:
+                            default: ""
                             description: |-
-                              CACertificateRefs contains one or more references to
-                              Kubernetes objects that contain TLS certificates of
-                              the Certificate Authorities that can be used
-                              as a trust anchor to validate the certificates presented by the client.
-
-                              A single CA certificate reference to a Kubernetes ConfigMap
-                              has "Core" support.
-                              Implementations MAY choose to support attaching multiple CA certificates to
-                              a Listener, but this behavior is implementation-specific.
-
-                              Support: Core - A single reference to a Kubernetes ConfigMap
-                              with the CA certificate in a key named `ca.crt`.
-
-                              Support: Implementation-specific (More than one certificate in a ConfigMap
-                              with different keys or more than one reference, or other kinds of resources).
-
-                              References to a resource in a different namespace are invalid UNLESS there
-                              is a ReferenceGrant in the target namespace that allows the certificate
-                              to be attached. If a ReferenceGrant does not allow this reference, the
-                              "ResolvedRefs" condition MUST be set to False for this listener with the
-                              "RefNotPermitted" reason.
-                            items:
-                              description: |-
-                                ObjectReference identifies an API object including its namespace.
-
-                                The API object must be valid in the cluster; the Group and Kind must
-                                be registered in the cluster for this reference to be valid.
-
-                                References to objects with invalid Group and Kind are not valid, and must
-                                be rejected by the implementation, with appropriate Conditions set
-                                on the containing object.
-                              properties:
-                                group:
-                                  description: |-
-                                    Group is the group of the referent. For example, "gateway.networking.k8s.io".
-                                    When set to the empty string, core API group is inferred.
-                                  maxLength: 253
-                                  pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
-                                  type: string
-                                kind:
-                                  description: Kind is kind of the referent. For example
-                                    "ConfigMap" or "Service".
-                                  maxLength: 63
-                                  minLength: 1
-                                  pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
-                                  type: string
-                                name:
-                                  description: Name is the name of the referent.
-                                  maxLength: 253
-                                  minLength: 1
-                                  type: string
-                                namespace:
-                                  description: |-
-                                    Namespace is the namespace of the referenced object. When unspecified, the local
-                                    namespace is inferred.
-
-                                    Note that when a namespace different than the local namespace is specified,
-                                    a ReferenceGrant object is required in the referent namespace to allow that
-                                    namespace's owner to accept the reference. See the ReferenceGrant
-                                    documentation for details.
-
-                                    Support: Core
-                                  maxLength: 63
-                                  minLength: 1
-                                  pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
-                                  type: string
-                              required:
-                              - group
-                              - kind
-                              - name
-                              type: object
-                            maxItems: 8
-                            minItems: 1
-                            type: array
-                            x-kubernetes-list-type: atomic
-                          mode:
-                            default: AllowValidOnly
+                              Group is the group of the referent. For example, "gateway.networking.k8s.io".
+                              When unspecified or empty string, core API group is inferred.
+                            maxLength: 253
+                            pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                            type: string
+                          kind:
+                            default: Secret
+                            description: Kind is kind of the referent. For example
+                              "Secret".
+                            maxLength: 63
+                            minLength: 1
+                            pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                            type: string
+                          name:
+                            description: Name is the name of the referent.
+                            maxLength: 253
+                            minLength: 1
+                            type: string
+                          namespace:
                             description: |-
-                              FrontendValidationMode defines the mode for validating the client certificate.
-                              There are two possible modes:
-
-                              - AllowValidOnly: In this mode, the gateway will accept connections only if
-                                the client presents a valid certificate. This certificate must successfully
-                                pass validation against the CA certificates specified in `CACertificateRefs`.
-                              - AllowInsecureFallback: In this mode, the gateway will accept connections
-                                even if the client certificate is not presented or fails verification.
+                              Namespace is the namespace of the referenced object. When unspecified, the local
+                              namespace is inferred.
 
-                                This approach delegates client authorization to the backend and introduce
-                                a significant security risk. It should be used in testing environments or
-                                on a temporary basis in non-testing environments.
-
-                              Defaults to AllowValidOnly.
+                              Note that when a namespace different than the local namespace is specified,
+                              a ReferenceGrant object is required in the referent namespace to allow that
+                              namespace's owner to accept the reference. See the ReferenceGrant
+                              documentation for details.
 
                               Support: Core
-                            enum:
-                            - AllowValidOnly
-                            - AllowInsecureFallback
+                            maxLength: 63
+                            minLength: 1
+                            pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
                             type: string
                         required:
-                        - caCertificateRefs
+                        - name
                         type: object
-                    required:
-                    - frontendValidation
                     type: object
-                  perPort:
+                  frontend:
                     description: |-
-                      PerPort specifies tls configuration assigned per port.
-                      Per port configuration is optional. Once set this configuration overrides
-                      the default configuration for all Listeners handling HTTPS traffic
-                      that match this port.
-                      Each override port requires a unique TLS configuration.
-
-                      support: Core
-                    items:
-                      properties:
-                        port:
-                          description: |-
-                            The Port indicates the Port Number to which the TLS configuration will be
-                            applied. This configuration will be applied to all Listeners handling HTTPS
-                            traffic that match this port.
-
-                            Support: Core
-                          format: int32
-                          maximum: 65535
-                          minimum: 1
-                          type: integer
-                        tls:
-                          description: |-
-                            TLS store the configuration that will be applied to all Listeners handling
-                            HTTPS traffic and matching given port.
+                      Frontend describes TLS config when client connects to Gateway.
+                      Support: Core
+                    properties:
+                      default:
+                        description: |-
+                          Default specifies the default client certificate validation configuration
+                          for all Listeners handling HTTPS traffic, unless a per-port configuration
+                          is defined.
 
-                            Support: Core
-                          properties:
-                            frontendValidation:
-                              description: |-
-                                FrontendValidation holds configuration information for validating the frontend (client).
-                                Setting this field will result in mutual authentication when connecting to the gateway.
-                                In browsers this may result in a dialog appearing
-                                that requests a user to specify the client certificate.
-                                The maximum depth of a certificate chain accepted in verification is Implementation specific.
+                          support: Core
+                        properties:
+                          validation:
+                            description: |-
+                              Validation holds configuration information for validating the frontend (client).
+                              Setting this field will result in mutual authentication when connecting to the gateway.
+                              In browsers this may result in a dialog appearing
+                              that requests a user to specify the client certificate.
+                              The maximum depth of a certificate chain accepted in verification is Implementation specific.
 
-                                Support: Core
-                              properties:
-                                caCertificateRefs:
+                              Support: Core
+                            properties:
+                              caCertificateRefs:
+                                description: |-
+                                  CACertificateRefs contains one or more references to
+                                  Kubernetes objects that contain TLS certificates of
+                                  the Certificate Authorities that can be used
+                                  as a trust anchor to validate the certificates presented by the client.
+
+                                  A single CA certificate reference to a Kubernetes ConfigMap
+                                  has "Core" support.
+                                  Implementations MAY choose to support attaching multiple CA certificates to
+                                  a Listener, but this behavior is implementation-specific.
+
+                                  Support: Core - A single reference to a Kubernetes ConfigMap
+                                  with the CA certificate in a key named `ca.crt`.
+
+                                  Support: Implementation-specific (More than one certificate in a ConfigMap
+                                  with different keys or more than one reference, or other kinds of resources).
+
+                                  References to a resource in a different namespace are invalid UNLESS there
+                                  is a ReferenceGrant in the target namespace that allows the certificate
+                                  to be attached. If a ReferenceGrant does not allow this reference, the
+                                  "ResolvedRefs" condition MUST be set to False for this listener with the
+                                  "RefNotPermitted" reason.
+                                items:
                                   description: |-
-                                    CACertificateRefs contains one or more references to
-                                    Kubernetes objects that contain TLS certificates of
-                                    the Certificate Authorities that can be used
-                                    as a trust anchor to validate the certificates presented by the client.
-
-                                    A single CA certificate reference to a Kubernetes ConfigMap
-                                    has "Core" support.
-                                    Implementations MAY choose to support attaching multiple CA certificates to
-                                    a Listener, but this behavior is implementation-specific.
-
-                                    Support: Core - A single reference to a Kubernetes ConfigMap
-                                    with the CA certificate in a key named `ca.crt`.
-
-                                    Support: Implementation-specific (More than one certificate in a ConfigMap
-                                    with different keys or more than one reference, or other kinds of resources).
-
-                                    References to a resource in a different namespace are invalid UNLESS there
-                                    is a ReferenceGrant in the target namespace that allows the certificate
-                                    to be attached. If a ReferenceGrant does not allow this reference, the
-                                    "ResolvedRefs" condition MUST be set to False for this listener with the
-                                    "RefNotPermitted" reason.
-                                  items:
-                                    description: |-
-                                      ObjectReference identifies an API object including its namespace.
+                                    ObjectReference identifies an API object including its namespace.
+
+                                    The API object must be valid in the cluster; the Group and Kind must
+                                    be registered in the cluster for this reference to be valid.
+
+                                    References to objects with invalid Group and Kind are not valid, and must
+                                    be rejected by the implementation, with appropriate Conditions set
+                                    on the containing object.
+                                  properties:
+                                    group:
+                                      description: |-
+                                        Group is the group of the referent. For example, "gateway.networking.k8s.io".
+                                        When set to the empty string, core API group is inferred.
+                                      maxLength: 253
+                                      pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                      type: string
+                                    kind:
+                                      description: Kind is kind of the referent. For
+                                        example "ConfigMap" or "Service".
+                                      maxLength: 63
+                                      minLength: 1
+                                      pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                                      type: string
+                                    name:
+                                      description: Name is the name of the referent.
+                                      maxLength: 253
+                                      minLength: 1
+                                      type: string
+                                    namespace:
+                                      description: |-
+                                        Namespace is the namespace of the referenced object. When unspecified, the local
+                                        namespace is inferred.
+
+                                        Note that when a namespace different than the local namespace is specified,
+                                        a ReferenceGrant object is required in the referent namespace to allow that
+                                        namespace's owner to accept the reference. See the ReferenceGrant
+                                        documentation for details.
+
+                                        Support: Core
+                                      maxLength: 63
+                                      minLength: 1
+                                      pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+                                      type: string
+                                  required:
+                                  - group
+                                  - kind
+                                  - name
+                                  type: object
+                                maxItems: 8
+                                minItems: 1
+                                type: array
+                                x-kubernetes-list-type: atomic
+                              mode:
+                                default: AllowValidOnly
+                                description: |-
+                                  FrontendValidationMode defines the mode for validating the client certificate.
+                                  There are two possible modes:
 
-                                      The API object must be valid in the cluster; the Group and Kind must
-                                      be registered in the cluster for this reference to be valid.
+                                  - AllowValidOnly: In this mode, the gateway will accept connections only if
+                                    the client presents a valid certificate. This certificate must successfully
+                                    pass validation against the CA certificates specified in `CACertificateRefs`.
+                                  - AllowInsecureFallback: In this mode, the gateway will accept connections
+                                    even if the client certificate is not presented or fails verification.
 
-                                      References to objects with invalid Group and Kind are not valid, and must
-                                      be rejected by the implementation, with appropriate Conditions set
-                                      on the containing object.
-                                    properties:
-                                      group:
-                                        description: |-
-                                          Group is the group of the referent. For example, "gateway.networking.k8s.io".
-                                          When set to the empty string, core API group is inferred.
-                                        maxLength: 253
-                                        pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
-                                        type: string
-                                      kind:
-                                        description: Kind is kind of the referent.
-                                          For example "ConfigMap" or "Service".
-                                        maxLength: 63
-                                        minLength: 1
-                                        pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
-                                        type: string
-                                      name:
-                                        description: Name is the name of the referent.
-                                        maxLength: 253
-                                        minLength: 1
-                                        type: string
-                                      namespace:
-                                        description: |-
-                                          Namespace is the namespace of the referenced object. When unspecified, the local
-                                          namespace is inferred.
-
-                                          Note that when a namespace different than the local namespace is specified,
-                                          a ReferenceGrant object is required in the referent namespace to allow that
-                                          namespace's owner to accept the reference. See the ReferenceGrant
-                                          documentation for details.
-
-                                          Support: Core
-                                        maxLength: 63
-                                        minLength: 1
-                                        pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
-                                        type: string
-                                    required:
-                                    - group
-                                    - kind
-                                    - name
-                                    type: object
-                                  maxItems: 8
-                                  minItems: 1
-                                  type: array
-                                  x-kubernetes-list-type: atomic
-                                mode:
-                                  default: AllowValidOnly
-                                  description: |-
-                                    FrontendValidationMode defines the mode for validating the client certificate.
-                                    There are two possible modes:
+                                    This approach delegates client authorization to the backend and introduce
+                                    a significant security risk. It should be used in testing environments or
+                                    on a temporary basis in non-testing environments.
 
-                                    - AllowValidOnly: In this mode, the gateway will accept connections only if
-                                      the client presents a valid certificate. This certificate must successfully
-                                      pass validation against the CA certificates specified in `CACertificateRefs`.
-                                    - AllowInsecureFallback: In this mode, the gateway will accept connections
-                                      even if the client certificate is not presented or fails verification.
+                                  Defaults to AllowValidOnly.
 
-                                      This approach delegates client authorization to the backend and introduce
-                                      a significant security risk. It should be used in testing environments or
-                                      on a temporary basis in non-testing environments.
+                                  Support: Core
+                                enum:
+                                - AllowValidOnly
+                                - AllowInsecureFallback
+                                type: string
+                            required:
+                            - caCertificateRefs
+                            type: object
+                        type: object
+                      perPort:
+                        description: |-
+                          PerPort specifies tls configuration assigned per port.
+                          Per port configuration is optional. Once set this configuration overrides
+                          the default configuration for all Listeners handling HTTPS traffic
+                          that match this port.
+                          Each override port requires a unique TLS configuration.
+
+                          support: Core
+                        items:
+                          properties:
+                            port:
+                              description: |-
+                                The Port indicates the Port Number to which the TLS configuration will be
+                                applied. This configuration will be applied to all Listeners handling HTTPS
+                                traffic that match this port.
+
+                                Support: Core
+                              format: int32
+                              maximum: 65535
+                              minimum: 1
+                              type: integer
+                            tls:
+                              description: |-
+                                TLS store the configuration that will be applied to all Listeners handling
+                                HTTPS traffic and matching given port.
 
-                                    Defaults to AllowValidOnly.
+                                Support: Core
+                              properties:
+                                validation:
+                                  description: |-
+                                    Validation holds configuration information for validating the frontend (client).
+                                    Setting this field will result in mutual authentication when connecting to the gateway.
+                                    In browsers this may result in a dialog appearing
+                                    that requests a user to specify the client certificate.
+                                    The maximum depth of a certificate chain accepted in verification is Implementation specific.
 
                                     Support: Core
-                                  enum:
-                                  - AllowValidOnly
-                                  - AllowInsecureFallback
-                                  type: string
-                              required:
-                              - caCertificateRefs
+                                  properties:
+                                    caCertificateRefs:
+                                      description: |-
+                                        CACertificateRefs contains one or more references to
+                                        Kubernetes objects that contain TLS certificates of
+                                        the Certificate Authorities that can be used
+                                        as a trust anchor to validate the certificates presented by the client.
+
+                                        A single CA certificate reference to a Kubernetes ConfigMap
+                                        has "Core" support.
+                                        Implementations MAY choose to support attaching multiple CA certificates to
+                                        a Listener, but this behavior is implementation-specific.
+
+                                        Support: Core - A single reference to a Kubernetes ConfigMap
+                                        with the CA certificate in a key named `ca.crt`.
+
+                                        Support: Implementation-specific (More than one certificate in a ConfigMap
+                                        with different keys or more than one reference, or other kinds of resources).
+
+                                        References to a resource in a different namespace are invalid UNLESS there
+                                        is a ReferenceGrant in the target namespace that allows the certificate
+                                        to be attached. If a ReferenceGrant does not allow this reference, the
+                                        "ResolvedRefs" condition MUST be set to False for this listener with the
+                                        "RefNotPermitted" reason.
+                                      items:
+                                        description: |-
+                                          ObjectReference identifies an API object including its namespace.
+
+                                          The API object must be valid in the cluster; the Group and Kind must
+                                          be registered in the cluster for this reference to be valid.
+
+                                          References to objects with invalid Group and Kind are not valid, and must
+                                          be rejected by the implementation, with appropriate Conditions set
+                                          on the containing object.
+                                        properties:
+                                          group:
+                                            description: |-
+                                              Group is the group of the referent. For example, "gateway.networking.k8s.io".
+                                              When set to the empty string, core API group is inferred.
+                                            maxLength: 253
+                                            pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                            type: string
+                                          kind:
+                                            description: Kind is kind of the referent.
+                                              For example "ConfigMap" or "Service".
+                                            maxLength: 63
+                                            minLength: 1
+                                            pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                                            type: string
+                                          name:
+                                            description: Name is the name of the referent.
+                                            maxLength: 253
+                                            minLength: 1
+                                            type: string
+                                          namespace:
+                                            description: |-
+                                              Namespace is the namespace of the referenced object. When unspecified, the local
+                                              namespace is inferred.
+
+                                              Note that when a namespace different than the local namespace is specified,
+                                              a ReferenceGrant object is required in the referent namespace to allow that
+                                              namespace's owner to accept the reference. See the ReferenceGrant
+                                              documentation for details.
+
+                                              Support: Core
+                                            maxLength: 63
+                                            minLength: 1
+                                            pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+                                            type: string
+                                        required:
+                                        - group
+                                        - kind
+                                        - name
+                                        type: object
+                                      maxItems: 8
+                                      minItems: 1
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    mode:
+                                      default: AllowValidOnly
+                                      description: |-
+                                        FrontendValidationMode defines the mode for validating the client certificate.
+                                        There are two possible modes:
+
+                                        - AllowValidOnly: In this mode, the gateway will accept connections only if
+                                          the client presents a valid certificate. This certificate must successfully
+                                          pass validation against the CA certificates specified in `CACertificateRefs`.
+                                        - AllowInsecureFallback: In this mode, the gateway will accept connections
+                                          even if the client certificate is not presented or fails verification.
+
+                                          This approach delegates client authorization to the backend and introduce
+                                          a significant security risk. It should be used in testing environments or
+                                          on a temporary basis in non-testing environments.
+
+                                        Defaults to AllowValidOnly.
+
+                                        Support: Core
+                                      enum:
+                                      - AllowValidOnly
+                                      - AllowInsecureFallback
+                                      type: string
+                                  required:
+                                  - caCertificateRefs
+                                  type: object
                               type: object
                           required:
-                          - frontendValidation
+                          - port
+                          - tls
                           type: object
-                      required:
-                      - port
-                      - tls
-                      type: object
-                    maxItems: 64
-                    type: array
-                    x-kubernetes-list-map-keys:
-                    - port
-                    x-kubernetes-list-type: map
-                    x-kubernetes-validations:
-                    - message: Port for TLS configuration must be unique within the
-                        Gateway
-                      rule: self.all(t1, self.exists_one(t2, t1.port == t2.port))
-                required:
-                - default
+                        maxItems: 64
+                        type: array
+                        x-kubernetes-list-map-keys:
+                        - port
+                        x-kubernetes-list-type: map
+                        x-kubernetes-validations:
+                        - message: Port for TLS configuration must be unique within
+                            the Gateway
+                          rule: self.all(t1, self.exists_one(t2, t1.port == t2.port))
+                    required:
+                    - default
+                    type: object
                 type: object
             required:
             - gatewayClassName
diff --git a/conformance/base/manifests.yaml b/conformance/base/manifests.yaml
index 9380223e..d8f8c45a 100644
--- a/conformance/base/manifests.yaml
+++ b/conformance/base/manifests.yaml
@@ -95,6 +95,39 @@ spec:
           matchLabels:
             gateway-conformance: backend
 ---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: gateway-backendtlspolicy
+  namespace: gateway-conformance-infra
+spec:
+  gatewayClassName: "{GATEWAY_CLASS_NAME}"
+  listeners:
+  - name: http
+    port: 80
+    protocol: HTTP
+    hostname: "abc.example.com"
+    allowedRoutes:
+      namespaces:
+        from: Same
+      kinds:
+      - kind: HTTPRoute
+  - name: https
+    port: 443
+    protocol: HTTPS
+    tls:
+      mode: Terminate
+      certificateRefs:
+      - group: ""
+        kind: Secret
+        name: tls-checks-certificate
+    hostname: "abc.example.com"
+    allowedRoutes:
+      namespaces:
+        from: Same
+      kinds:
+      - kind: HTTPRoute
+---
 apiVersion: v1
 kind: Service
 metadata:
diff --git a/conformance/reports/v1.1.0/airlock-microgateway/README.md b/conformance/reports/v1.1.0/airlock-microgateway/README.md
index a23522a4..37084e90 100644
--- a/conformance/reports/v1.1.0/airlock-microgateway/README.md
+++ b/conformance/reports/v1.1.0/airlock-microgateway/README.md
@@ -4,19 +4,20 @@
 
 | API channel  | Implementation version                                               | Mode    | Report                                           |
 |--------------|----------------------------------------------------------------------|---------|--------------------------------------------------|
-| experimental | [v4.4.0](https://github.com/airlock/microgateway/releases/tag/4.4.0) | default | [v4.4.0 report](./experimental-4.4.0-default-report.yaml) |
-| standard     | [v4.5.0](https://github.com/airlock/microgateway/releases/tag/4.5.0) | default | [v4.5.0 report](./standard-4.5.0-default-report.yaml)     |
-| standard     | [v4.6.0](https://github.com/airlock/microgateway/releases/tag/4.6.0) | default | [v4.6.0 report](./standard-4.6.0-default-report.yaml)     |
+| experimental | [v4.4.0](https://github.com/airlock/microgateway/releases/tag/4.4.0) | default | [link](./experimental-4.4.0-default-report.yaml) |
+| standard     | [v4.5.0](https://github.com/airlock/microgateway/releases/tag/4.5.0) | default | [link](./standard-4.5.0-default-report.yaml)     |
+| standard    | [v4.6.0](https://github.com/airlock/microgateway/releases/tag/4.6.0) | default | [link](./standard-4.6.0-default-report.yaml) |
+| standard    | [v4.7.0](https://github.com/airlock/microgateway/releases/tag/4.7.0) | default | [link](./standard-4.7.0-default-report.yaml) |
 
 ## Reproduce
 
-The Airlock Microgateway conformance report can be reproduced by following the steps in the [Gateway API conformance guide](https://github.com/airlock/microgateway/tree/main/examples/gateway-api/conformance/conformance.md) on GitHub.
+The Airlock Microgateway conformance report can be reproduced by following the steps in the [Gateway API conformance guide](https://github.com/airlock/microgateway/tree/main/gateway-api/conformance/conformance.md) on GitHub.
 
 > [!NOTE]
 > The `HTTPRouteWeight` test fires 10 concurrent request to 3 backends totaling in 500 requests to assert a distribution that matches the configured weight.
-> Please be aware that this test exceeds the [5 req/sec rate-limit](https://docs.airlock.com/microgateway/latest/#data/1675772882054.html) enforced in the <!-- markdown-link-check-disable --> [community edition](https://www.airlock.com/en/secure-access-hub/components/microgateway/community-edition) <!-- markdown-link-check-enable -->, causing the test to fail.
+> Please be aware that this test exceeds the [5 req/sec rate-limit](https://docs.airlock.com/microgateway/latest/?topic=MGW-00000056) enforced in the <!-- markdown-link-check-disable --> [community edition](https://www.airlock.com/en/secure-access-hub/components/microgateway/community-edition) <!-- markdown-link-check-enable -->, causing the test to fail.
 > To successfully pass this test a <!-- markdown-link-check-disable --> [premium license](https://www.airlock.com/en/secure-access-hub/components/microgateway/premium-edition)  <!-- markdown-link-check-enable --> is required.
 > 
 > The Airlock Microgateway drops all request headers except for a well-known built-in standard and tracing headers list (e.g., Accept, Cookie, X-CSRF-TOKEN) to reduce the attack surface.
-> Therefore, to run the conformance tests, a `ContentSecurityPolicy` with a `HeaderRewrites` (see [`conformance-report.yaml`](https://github.com/airlock/microgateway/tree/main/examples/gateway-api/conformance/manifests/conformance-report.yaml)) is required to disable request header filtering for all `HTTPRoute` tests relying on the `MakeRequestAndExpectEventuallyConsistentResponse` assertion.
-> Regardless of whether request header filtering is enabled or disabled, header-based routing works as specified in the Gateway API, as the headers are only filtered before the request is forwarded to the upstream.
\ No newline at end of file
+> Therefore, to run the conformance tests, a `ContentSecurityPolicy` with a `HeaderRewrites` (see [`conformance-report.yaml`](https://github.com/airlock/microgateway/tree/main/gateway-api/conformance/manifests/conformance-report.yaml)) is required to disable request header filtering for all `HTTPRoute` tests relying on the `MakeRequestAndExpectEventuallyConsistentResponse` assertion.
+> Regardless of whether request header filtering is enabled or disabled, header-based routing works as specified in the Gateway API, as the headers are only filtered before the request is forwarded to the upstream.
diff --git a/conformance/reports/v1.1.0/airlock-microgateway/standard-4.7.0-default-report.yaml b/conformance/reports/v1.1.0/airlock-microgateway/standard-4.7.0-default-report.yaml
new file mode 100644
index 00000000..37091df4
--- /dev/null
+++ b/conformance/reports/v1.1.0/airlock-microgateway/standard-4.7.0-default-report.yaml
@@ -0,0 +1,47 @@
+apiVersion: gateway.networking.k8s.io/v1alpha1
+date: "2025-08-25T13:36:52Z"
+gatewayAPIChannel: standard
+gatewayAPIVersion: v1.1.0
+implementation:
+  contact:
+  - https://www.airlock.com/en/contact
+  organization: airlock
+  project: microgateway
+  url: https://github.com/airlock/microgateway
+  version: 4.7.0
+kind: ConformanceReport
+mode: default
+profiles:
+- core:
+    result: success
+    statistics:
+      Failed: 0
+      Passed: 33
+      Skipped: 0
+  extended:
+    result: success
+    statistics:
+      Failed: 0
+      Passed: 12
+      Skipped: 0
+    supportedFeatures:
+    - GatewayPort8080
+    - HTTPRouteHostRewrite
+    - HTTPRouteMethodMatching
+    - HTTPRouteParentRefPort
+    - HTTPRoutePathRedirect
+    - HTTPRoutePathRewrite
+    - HTTPRoutePortRedirect
+    - HTTPRouteQueryParamMatching
+    - HTTPRouteResponseHeaderModification
+    - HTTPRouteSchemeRedirect
+    unsupportedFeatures:
+    - GatewayHTTPListenerIsolation
+    - GatewayStaticAddresses
+    - HTTPRouteBackendRequestHeaderModification
+    - HTTPRouteBackendTimeout
+    - HTTPRouteRequestMirror
+    - HTTPRouteRequestMultipleMirrors
+    - HTTPRouteRequestTimeout
+  name: GATEWAY-HTTP
+  summary: Core tests succeeded. Extended tests succeeded.
diff --git a/conformance/reports/v1.1.1/airlock-microgateway/README.md b/conformance/reports/v1.1.1/airlock-microgateway/README.md
index a61abd83..66143c04 100644
--- a/conformance/reports/v1.1.1/airlock-microgateway/README.md
+++ b/conformance/reports/v1.1.1/airlock-microgateway/README.md
@@ -6,16 +6,17 @@
 |-------------|----------------------------------------------------------------------|---------|----------------------------------------------|
 | standard    | [v4.5.0](https://github.com/airlock/microgateway/releases/tag/4.5.0) | default | [link](./standard-4.5.0-default-report.yaml) |
 | standard    | [v4.6.0](https://github.com/airlock/microgateway/releases/tag/4.6.0) | default | [link](./standard-4.6.0-default-report.yaml) |
+| standard    | [v4.7.0](https://github.com/airlock/microgateway/releases/tag/4.7.0) | default | [link](./standard-4.7.0-default-report.yaml) |
 
 ## Reproduce
 
-The Airlock Microgateway conformance report can be reproduced by following the steps in the [Gateway API conformance guide](https://github.com/airlock/microgateway/tree/main/examples/gateway-api/conformance/conformance.md) on GitHub.
+The Airlock Microgateway conformance report can be reproduced by following the steps in the [Gateway API conformance guide](https://github.com/airlock/microgateway/tree/main/gateway-api/conformance/conformance.md) on GitHub.
 
 > [!NOTE]
 > The `HTTPRouteWeight` test fires 10 concurrent request to 3 backends totaling in 500 requests to assert a distribution that matches the configured weight.
-> Please be aware that this test exceeds the [5 req/sec rate-limit](https://docs.airlock.com/microgateway/latest/#data/1675772882054.html) enforced in the <!-- markdown-link-check-disable --> [community edition](https://www.airlock.com/en/secure-access-hub/components/microgateway/community-edition) <!-- markdown-link-check-enable -->, causing the test to fail.
+> Please be aware that this test exceeds the [5 req/sec rate-limit](https://docs.airlock.com/microgateway/latest/?topic=MGW-00000056) enforced in the <!-- markdown-link-check-disable --> [community edition](https://www.airlock.com/en/secure-access-hub/components/microgateway/community-edition) <!-- markdown-link-check-enable -->, causing the test to fail.
 > To successfully pass this test a <!-- markdown-link-check-disable --> [premium license](https://www.airlock.com/en/secure-access-hub/components/microgateway/premium-edition)  <!-- markdown-link-check-enable --> is required.
 > 
 > The Airlock Microgateway drops all request headers except for a well-known built-in standard and tracing headers list (e.g., Accept, Cookie, X-CSRF-TOKEN) to reduce the attack surface.
-> Therefore, to run the conformance tests, a `ContentSecurityPolicy` with a `HeaderRewrites` (see [`conformance-report.yaml`](https://github.com/airlock/microgateway/tree/main/examples/gateway-api/conformance/manifests/conformance-report.yaml)) is required to disable request header filtering for all `HTTPRoute` tests relying on the `MakeRequestAndExpectEventuallyConsistentResponse` assertion.
-> Regardless of whether request header filtering is enabled or disabled, header-based routing works as specified in the Gateway API, as the headers are only filtered before the request is forwarded to the upstream.
\ No newline at end of file
+> Therefore, to run the conformance tests, a `ContentSecurityPolicy` with a `HeaderRewrites` (see [`conformance-report.yaml`](https://github.com/airlock/microgateway/tree/main/gateway-api/conformance/manifests/conformance-report.yaml)) is required to disable request header filtering for all `HTTPRoute` tests relying on the `MakeRequestAndExpectEventuallyConsistentResponse` assertion.
+> Regardless of whether request header filtering is enabled or disabled, header-based routing works as specified in the Gateway API, as the headers are only filtered before the request is forwarded to the upstream.
diff --git a/conformance/reports/v1.1.1/airlock-microgateway/standard-4.7.0-default-report.yaml b/conformance/reports/v1.1.1/airlock-microgateway/standard-4.7.0-default-report.yaml
new file mode 100644
index 00000000..3bc63624
--- /dev/null
+++ b/conformance/reports/v1.1.1/airlock-microgateway/standard-4.7.0-default-report.yaml
@@ -0,0 +1,47 @@
+apiVersion: gateway.networking.k8s.io/v1alpha1
+date: "2025-08-25T13:37:05Z"
+gatewayAPIChannel: standard
+gatewayAPIVersion: v1.1.1
+implementation:
+  contact:
+  - https://www.airlock.com/en/contact
+  organization: airlock
+  project: microgateway
+  url: https://github.com/airlock/microgateway
+  version: 4.7.0
+kind: ConformanceReport
+mode: default
+profiles:
+- core:
+    result: success
+    statistics:
+      Failed: 0
+      Passed: 33
+      Skipped: 0
+  extended:
+    result: success
+    statistics:
+      Failed: 0
+      Passed: 12
+      Skipped: 0
+    supportedFeatures:
+    - GatewayPort8080
+    - HTTPRouteHostRewrite
+    - HTTPRouteMethodMatching
+    - HTTPRouteParentRefPort
+    - HTTPRoutePathRedirect
+    - HTTPRoutePathRewrite
+    - HTTPRoutePortRedirect
+    - HTTPRouteQueryParamMatching
+    - HTTPRouteResponseHeaderModification
+    - HTTPRouteSchemeRedirect
+    unsupportedFeatures:
+    - GatewayHTTPListenerIsolation
+    - GatewayStaticAddresses
+    - HTTPRouteBackendRequestHeaderModification
+    - HTTPRouteBackendTimeout
+    - HTTPRouteRequestMirror
+    - HTTPRouteRequestMultipleMirrors
+    - HTTPRouteRequestTimeout
+  name: GATEWAY-HTTP
+  summary: Core tests succeeded. Extended tests succeeded.
diff --git a/conformance/reports/v1.2.0/airlock-microgateway/README.md b/conformance/reports/v1.2.0/airlock-microgateway/README.md
index a61abd83..66143c04 100644
--- a/conformance/reports/v1.2.0/airlock-microgateway/README.md
+++ b/conformance/reports/v1.2.0/airlock-microgateway/README.md
@@ -6,16 +6,17 @@
 |-------------|----------------------------------------------------------------------|---------|----------------------------------------------|
 | standard    | [v4.5.0](https://github.com/airlock/microgateway/releases/tag/4.5.0) | default | [link](./standard-4.5.0-default-report.yaml) |
 | standard    | [v4.6.0](https://github.com/airlock/microgateway/releases/tag/4.6.0) | default | [link](./standard-4.6.0-default-report.yaml) |
+| standard    | [v4.7.0](https://github.com/airlock/microgateway/releases/tag/4.7.0) | default | [link](./standard-4.7.0-default-report.yaml) |
 
 ## Reproduce
 
-The Airlock Microgateway conformance report can be reproduced by following the steps in the [Gateway API conformance guide](https://github.com/airlock/microgateway/tree/main/examples/gateway-api/conformance/conformance.md) on GitHub.
+The Airlock Microgateway conformance report can be reproduced by following the steps in the [Gateway API conformance guide](https://github.com/airlock/microgateway/tree/main/gateway-api/conformance/conformance.md) on GitHub.
 
 > [!NOTE]
 > The `HTTPRouteWeight` test fires 10 concurrent request to 3 backends totaling in 500 requests to assert a distribution that matches the configured weight.
-> Please be aware that this test exceeds the [5 req/sec rate-limit](https://docs.airlock.com/microgateway/latest/#data/1675772882054.html) enforced in the <!-- markdown-link-check-disable --> [community edition](https://www.airlock.com/en/secure-access-hub/components/microgateway/community-edition) <!-- markdown-link-check-enable -->, causing the test to fail.
+> Please be aware that this test exceeds the [5 req/sec rate-limit](https://docs.airlock.com/microgateway/latest/?topic=MGW-00000056) enforced in the <!-- markdown-link-check-disable --> [community edition](https://www.airlock.com/en/secure-access-hub/components/microgateway/community-edition) <!-- markdown-link-check-enable -->, causing the test to fail.
 > To successfully pass this test a <!-- markdown-link-check-disable --> [premium license](https://www.airlock.com/en/secure-access-hub/components/microgateway/premium-edition)  <!-- markdown-link-check-enable --> is required.
 > 
 > The Airlock Microgateway drops all request headers except for a well-known built-in standard and tracing headers list (e.g., Accept, Cookie, X-CSRF-TOKEN) to reduce the attack surface.
-> Therefore, to run the conformance tests, a `ContentSecurityPolicy` with a `HeaderRewrites` (see [`conformance-report.yaml`](https://github.com/airlock/microgateway/tree/main/examples/gateway-api/conformance/manifests/conformance-report.yaml)) is required to disable request header filtering for all `HTTPRoute` tests relying on the `MakeRequestAndExpectEventuallyConsistentResponse` assertion.
-> Regardless of whether request header filtering is enabled or disabled, header-based routing works as specified in the Gateway API, as the headers are only filtered before the request is forwarded to the upstream.
\ No newline at end of file
+> Therefore, to run the conformance tests, a `ContentSecurityPolicy` with a `HeaderRewrites` (see [`conformance-report.yaml`](https://github.com/airlock/microgateway/tree/main/gateway-api/conformance/manifests/conformance-report.yaml)) is required to disable request header filtering for all `HTTPRoute` tests relying on the `MakeRequestAndExpectEventuallyConsistentResponse` assertion.
+> Regardless of whether request header filtering is enabled or disabled, header-based routing works as specified in the Gateway API, as the headers are only filtered before the request is forwarded to the upstream.
diff --git a/conformance/reports/v1.2.0/airlock-microgateway/standard-4.7.0-default-report.yaml b/conformance/reports/v1.2.0/airlock-microgateway/standard-4.7.0-default-report.yaml
new file mode 100644
index 00000000..af660c02
--- /dev/null
+++ b/conformance/reports/v1.2.0/airlock-microgateway/standard-4.7.0-default-report.yaml
@@ -0,0 +1,53 @@
+apiVersion: gateway.networking.k8s.io/v1
+date: "2025-08-25T13:37:00Z"
+gatewayAPIChannel: standard
+gatewayAPIVersion: v1.2.0
+implementation:
+  contact:
+  - https://www.airlock.com/en/contact
+  organization: airlock
+  project: microgateway
+  url: https://github.com/airlock/microgateway
+  version: 4.7.0
+kind: ConformanceReport
+mode: default
+profiles:
+- core:
+    result: success
+    statistics:
+      Failed: 0
+      Passed: 33
+      Skipped: 0
+  extended:
+    result: success
+    statistics:
+      Failed: 0
+      Passed: 18
+      Skipped: 0
+    supportedFeatures:
+    - GatewayInfrastructurePropagation
+    - GatewayPort8080
+    - HTTPRouteBackendProtocolH2C
+    - HTTPRouteBackendProtocolWebSocket
+    - HTTPRouteBackendTimeout
+    - HTTPRouteDestinationPortMatching
+    - HTTPRouteHostRewrite
+    - HTTPRouteMethodMatching
+    - HTTPRouteParentRefPort
+    - HTTPRoutePathRedirect
+    - HTTPRoutePathRewrite
+    - HTTPRoutePortRedirect
+    - HTTPRouteQueryParamMatching
+    - HTTPRouteRequestTimeout
+    - HTTPRouteResponseHeaderModification
+    - HTTPRouteSchemeRedirect
+    unsupportedFeatures:
+    - GatewayHTTPListenerIsolation
+    - GatewayStaticAddresses
+    - HTTPRouteBackendRequestHeaderModification
+    - HTTPRouteRequestMirror
+    - HTTPRouteRequestMultipleMirrors
+  name: GATEWAY-HTTP
+  summary: Core tests succeeded. Extended tests succeeded.
+succeededProvisionalTests:
+- GatewayInfrastructure
diff --git a/conformance/reports/v1.2.1/airlock-microgateway/README.md b/conformance/reports/v1.2.1/airlock-microgateway/README.md
index 97c52418..e6c945be 100644
--- a/conformance/reports/v1.2.1/airlock-microgateway/README.md
+++ b/conformance/reports/v1.2.1/airlock-microgateway/README.md
@@ -5,17 +5,18 @@
 | API channel  | Implementation version                                               | Mode    | Report                                           |
 |--------------|----------------------------------------------------------------------|---------|--------------------------------------------------|
 | experimental | [v4.5.0](https://github.com/airlock/microgateway/releases/tag/4.5.0) | default | [link](./experimental-4.5.0-default-report.yaml) |
-| standard     | [v4.6.0](https://github.com/airlock/microgateway/releases/tag/4.6.0) | default | [link](./standard-4.6.0-default-report.yaml)     |
+| standard    | [v4.6.0](https://github.com/airlock/microgateway/releases/tag/4.6.0) | default | [link](./standard-4.6.0-default-report.yaml) |
+| standard    | [v4.7.0](https://github.com/airlock/microgateway/releases/tag/4.7.0) | default | [link](./standard-4.7.0-default-report.yaml) |
 
 ## Reproduce
 
-The Airlock Microgateway conformance report can be reproduced by following the steps in the [Gateway API conformance guide](https://github.com/airlock/microgateway/tree/main/examples/gateway-api/conformance/conformance.md) on GitHub.
+The Airlock Microgateway conformance report can be reproduced by following the steps in the [Gateway API conformance guide](https://github.com/airlock/microgateway/tree/main/gateway-api/conformance/conformance.md) on GitHub.
 
 > [!NOTE]
 > The `HTTPRouteWeight` test fires 10 concurrent request to 3 backends totaling in 500 requests to assert a distribution that matches the configured weight.
-> Please be aware that this test exceeds the [5 req/sec rate-limit](https://docs.airlock.com/microgateway/latest/#data/1675772882054.html) enforced in the <!-- markdown-link-check-disable --> [community edition](https://www.airlock.com/en/secure-access-hub/components/microgateway/community-edition) <!-- markdown-link-check-enable -->, causing the test to fail.
+> Please be aware that this test exceeds the [5 req/sec rate-limit](https://docs.airlock.com/microgateway/latest/?topic=MGW-00000056) enforced in the <!-- markdown-link-check-disable --> [community edition](https://www.airlock.com/en/secure-access-hub/components/microgateway/community-edition) <!-- markdown-link-check-enable -->, causing the test to fail.
 > To successfully pass this test a <!-- markdown-link-check-disable --> [premium license](https://www.airlock.com/en/secure-access-hub/components/microgateway/premium-edition)  <!-- markdown-link-check-enable --> is required.
 > 
 > The Airlock Microgateway drops all request headers except for a well-known built-in standard and tracing headers list (e.g., Accept, Cookie, X-CSRF-TOKEN) to reduce the attack surface.
-> Therefore, to run the conformance tests, a `ContentSecurityPolicy` with a `HeaderRewrites` (see [`conformance-report.yaml`](https://github.com/airlock/microgateway/tree/main/examples/gateway-api/conformance/manifests/conformance-report.yaml)) is required to disable request header filtering for all `HTTPRoute` tests relying on the `MakeRequestAndExpectEventuallyConsistentResponse` assertion.
-> Regardless of whether request header filtering is enabled or disabled, header-based routing works as specified in the Gateway API, as the headers are only filtered before the request is forwarded to the upstream.
\ No newline at end of file
+> Therefore, to run the conformance tests, a `ContentSecurityPolicy` with a `HeaderRewrites` (see [`conformance-report.yaml`](https://github.com/airlock/microgateway/tree/main/gateway-api/conformance/manifests/conformance-report.yaml)) is required to disable request header filtering for all `HTTPRoute` tests relying on the `MakeRequestAndExpectEventuallyConsistentResponse` assertion.
+> Regardless of whether request header filtering is enabled or disabled, header-based routing works as specified in the Gateway API, as the headers are only filtered before the request is forwarded to the upstream.
diff --git a/conformance/reports/v1.2.1/airlock-microgateway/standard-4.7.0-default-report.yaml b/conformance/reports/v1.2.1/airlock-microgateway/standard-4.7.0-default-report.yaml
new file mode 100644
index 00000000..53f5311c
--- /dev/null
+++ b/conformance/reports/v1.2.1/airlock-microgateway/standard-4.7.0-default-report.yaml
@@ -0,0 +1,53 @@
+apiVersion: gateway.networking.k8s.io/v1
+date: "2025-08-25T13:37:50Z"
+gatewayAPIChannel: standard
+gatewayAPIVersion: v1.2.1
+implementation:
+  contact:
+  - https://www.airlock.com/en/contact
+  organization: airlock
+  project: microgateway
+  url: https://github.com/airlock/microgateway
+  version: 4.7.0
+kind: ConformanceReport
+mode: default
+profiles:
+- core:
+    result: success
+    statistics:
+      Failed: 0
+      Passed: 33
+      Skipped: 0
+  extended:
+    result: success
+    statistics:
+      Failed: 0
+      Passed: 18
+      Skipped: 0
+    supportedFeatures:
+    - GatewayInfrastructurePropagation
+    - GatewayPort8080
+    - HTTPRouteBackendProtocolH2C
+    - HTTPRouteBackendProtocolWebSocket
+    - HTTPRouteBackendTimeout
+    - HTTPRouteDestinationPortMatching
+    - HTTPRouteHostRewrite
+    - HTTPRouteMethodMatching
+    - HTTPRouteParentRefPort
+    - HTTPRoutePathRedirect
+    - HTTPRoutePathRewrite
+    - HTTPRoutePortRedirect
+    - HTTPRouteQueryParamMatching
+    - HTTPRouteRequestTimeout
+    - HTTPRouteResponseHeaderModification
+    - HTTPRouteSchemeRedirect
+    unsupportedFeatures:
+    - GatewayHTTPListenerIsolation
+    - GatewayStaticAddresses
+    - HTTPRouteBackendRequestHeaderModification
+    - HTTPRouteRequestMirror
+    - HTTPRouteRequestMultipleMirrors
+  name: GATEWAY-HTTP
+  summary: Core tests succeeded. Extended tests succeeded.
+succeededProvisionalTests:
+- GatewayInfrastructure
diff --git a/conformance/reports/v1.3.0/airlock-microgateway/README.md b/conformance/reports/v1.3.0/airlock-microgateway/README.md
index bae978e3..62704570 100644
--- a/conformance/reports/v1.3.0/airlock-microgateway/README.md
+++ b/conformance/reports/v1.3.0/airlock-microgateway/README.md
@@ -5,16 +5,17 @@
 | API channel  | Implementation version                                               | Mode    | Report                                           |
 |--------------|----------------------------------------------------------------------|---------|--------------------------------------------------|
 | experimental | [v4.6.0](https://github.com/airlock/microgateway/releases/tag/4.6.0) | default | [link](./experimental-4.6.0-default-report.yaml) |
+| experimental    | [v4.7.0](https://github.com/airlock/microgateway/releases/tag/4.7.0) | default | [link](./experimental-4.7.0-default-report.yaml) |
 
 ## Reproduce
 
-The Airlock Microgateway conformance report can be reproduced by following the steps in the [Gateway API conformance guide](https://github.com/airlock/microgateway/tree/main/examples/gateway-api/conformance/conformance.md) on GitHub.
+The Airlock Microgateway conformance report can be reproduced by following the steps in the [Gateway API conformance guide](https://github.com/airlock/microgateway/tree/main/gateway-api/conformance/conformance.md) on GitHub.
 
 > [!NOTE]
 > The `HTTPRouteWeight` test fires 10 concurrent request to 3 backends totaling in 500 requests to assert a distribution that matches the configured weight.
-> Please be aware that this test exceeds the [5 req/sec rate-limit](https://docs.airlock.com/microgateway/latest/#data/1675772882054.html) enforced in the <!-- markdown-link-check-disable --> [community edition](https://www.airlock.com/en/secure-access-hub/components/microgateway/community-edition) <!-- markdown-link-check-enable -->, causing the test to fail.
+> Please be aware that this test exceeds the [5 req/sec rate-limit](https://docs.airlock.com/microgateway/latest/?topic=MGW-00000056) enforced in the <!-- markdown-link-check-disable --> [community edition](https://www.airlock.com/en/secure-access-hub/components/microgateway/community-edition) <!-- markdown-link-check-enable -->, causing the test to fail.
 > To successfully pass this test a <!-- markdown-link-check-disable --> [premium license](https://www.airlock.com/en/secure-access-hub/components/microgateway/premium-edition)  <!-- markdown-link-check-enable --> is required.
-> 
+>
 > The Airlock Microgateway drops all request headers except for a well-known built-in standard and tracing headers list (e.g., Accept, Cookie, X-CSRF-TOKEN) to reduce the attack surface.
-> Therefore, to run the conformance tests, a `ContentSecurityPolicy` with a `HeaderRewrites` (see [`conformance-report.yaml`](https://github.com/airlock/microgateway/tree/main/examples/gateway-api/conformance/manifests/conformance-report.yaml)) is required to disable request header filtering for all `HTTPRoute` tests relying on the `MakeRequestAndExpectEventuallyConsistentResponse` assertion.
-> Regardless of whether request header filtering is enabled or disabled, header-based routing works as specified in the Gateway API, as the headers are only filtered before the request is forwarded to the upstream.
\ No newline at end of file
+> Therefore, to run the conformance tests, a `ContentSecurityPolicy` with a `HeaderRewrites` (see [`conformance-report.yaml`](https://github.com/airlock/microgateway/tree/main/gateway-api/conformance/manifests/conformance-report.yaml)) is required to disable request header filtering for all `HTTPRoute` tests relying on the `MakeRequestAndExpectEventuallyConsistentResponse` assertion.
+> Regardless of whether request header filtering is enabled or disabled, header-based routing works as specified in the Gateway API, as the headers are only filtered before the request is forwarded to the upstream.
diff --git a/conformance/reports/v1.3.0/airlock-microgateway/experimental-4.7.0-default-report.yaml b/conformance/reports/v1.3.0/airlock-microgateway/experimental-4.7.0-default-report.yaml
new file mode 100644
index 00000000..000e7877
--- /dev/null
+++ b/conformance/reports/v1.3.0/airlock-microgateway/experimental-4.7.0-default-report.yaml
@@ -0,0 +1,55 @@
+apiVersion: gateway.networking.k8s.io/v1
+date: "2025-08-25T13:33:58Z"
+gatewayAPIChannel: experimental
+gatewayAPIVersion: v1.3.0
+implementation:
+  contact:
+  - https://www.airlock.com/en/contact
+  organization: airlock
+  project: microgateway
+  url: https://github.com/airlock/microgateway
+  version: 4.7.0
+kind: ConformanceReport
+mode: default
+profiles:
+- core:
+    result: success
+    statistics:
+      Failed: 0
+      Passed: 33
+      Skipped: 0
+  extended:
+    result: success
+    statistics:
+      Failed: 0
+      Passed: 18
+      Skipped: 0
+    supportedFeatures:
+    - GatewayInfrastructurePropagation
+    - GatewayPort8080
+    - HTTPRouteBackendProtocolH2C
+    - HTTPRouteBackendProtocolWebSocket
+    - HTTPRouteBackendTimeout
+    - HTTPRouteDestinationPortMatching
+    - HTTPRouteHostRewrite
+    - HTTPRouteMethodMatching
+    - HTTPRouteParentRefPort
+    - HTTPRoutePathRedirect
+    - HTTPRoutePathRewrite
+    - HTTPRoutePortRedirect
+    - HTTPRouteQueryParamMatching
+    - HTTPRouteRequestTimeout
+    - HTTPRouteResponseHeaderModification
+    - HTTPRouteSchemeRedirect
+    unsupportedFeatures:
+    - GatewayAddressEmpty
+    - GatewayHTTPListenerIsolation
+    - GatewayStaticAddresses
+    - HTTPRouteBackendRequestHeaderModification
+    - HTTPRouteRequestMirror
+    - HTTPRouteRequestMultipleMirrors
+    - HTTPRouteRequestPercentageMirror
+  name: GATEWAY-HTTP
+  summary: Core tests succeeded. Extended tests succeeded.
+succeededProvisionalTests:
+- GatewayInfrastructure
diff --git a/conformance/utils/kubernetes/certificate.go b/conformance/utils/kubernetes/certificate.go
index 07c3c807..1b2ee3af 100644
--- a/conformance/utils/kubernetes/certificate.go
+++ b/conformance/utils/kubernetes/certificate.go
@@ -27,6 +27,7 @@ import (
 	"io"
 	"math/big"
 	"net"
+	"net/url"
 	"strings"
 	"testing"
 	"time"
@@ -119,6 +120,8 @@ func generateRSACert(hosts []string, keyOut, certOut io.Writer, ca *x509.Certifi
 			template.IPAddresses = append(template.IPAddresses, ip)
 		} else if err = validateHost(h); err == nil {
 			template.DNSNames = append(template.DNSNames, h)
+		} else if u, parseErr := url.Parse(h); parseErr == nil {
+			template.URIs = append(template.URIs, u)
 		}
 	}
 
@@ -215,6 +218,8 @@ func generateCACert(hosts []string) (*x509.Certificate, []byte, *rsa.PrivateKey,
 			ca.IPAddresses = append(ca.IPAddresses, ip)
 		} else if err := validateHost(h); err == nil {
 			ca.DNSNames = append(ca.DNSNames, h)
+		} else if u, err := url.Parse(h); err == nil {
+			ca.URIs = append(ca.URIs, u)
 		}
 	}
 
diff --git a/conformance/utils/kubernetes/helpers.go b/conformance/utils/kubernetes/helpers.go
index ea9b8af6..3309c8f2 100644
--- a/conformance/utils/kubernetes/helpers.go
+++ b/conformance/utils/kubernetes/helpers.go
@@ -1003,7 +1003,7 @@ func BackendTLSPolicyMustHaveCondition(t *testing.T, client client.Client, timeo
 		policy := &v1alpha3.BackendTLSPolicy{}
 		err := client.Get(ctx, policyNN, policy)
 		if err != nil {
-			return false, fmt.Errorf("error fetching BackendTLSPolicy: %w", err)
+			return false, fmt.Errorf("error fetching BackendTLSPolicy %v err: %w", policyNN, err)
 		}
 
 		for _, parent := range policy.Status.Ancestors {
@@ -1024,7 +1024,7 @@ func BackendTLSPolicyMustHaveCondition(t *testing.T, client client.Client, timeo
 		return false, nil
 	})
 
-	require.NoErrorf(t, waitErr, "error waiting for BackendTLSPolicy status to have a Condition %v", condition)
+	require.NoErrorf(t, waitErr, "error waiting for BackendTLSPolicy %v status to have a Condition %v", policyNN, condition)
 }
 
 // BackendTLSPolicyMustHaveLatestConditions will fail the test if there are
diff --git a/conformance/utils/suite/suite.go b/conformance/utils/suite/suite.go
index 23c93653..877c030f 100644
--- a/conformance/utils/suite/suite.go
+++ b/conformance/utils/suite/suite.go
@@ -394,6 +394,11 @@ func (suite *ConformanceTestSuite) Setup(t *testing.T, tests []ConformanceTest)
 		suite.Applier.MustApplyObjectsWithCleanup(t, suite.Client, suite.TimeoutConfig, []client.Object{caConfigMap}, suite.Cleanup)
 		secret = kubernetes.MustCreateCASignedCertSecret(t, "gateway-conformance-infra", "tls-checks-certificate", []string{"abc.example.com"}, ca, caPrivKey)
 		suite.Applier.MustApplyObjectsWithCleanup(t, suite.Client, suite.TimeoutConfig, []client.Object{secret}, suite.Cleanup)
+		// TODO(kl52752) Merge CA certificates for Backend TLS Policy and move Deployment to common file.
+		caConfigMap, ca, caPrivKey = kubernetes.MustCreateCACertConfigMap(t, "gateway-conformance-infra", "backend-tls-with-san-certificate", []string{"abc.example.com", "spiffe://abc.example.com/test-identity"})
+		suite.Applier.MustApplyObjectsWithCleanup(t, suite.Client, suite.TimeoutConfig, []client.Object{caConfigMap}, suite.Cleanup)
+		secret = kubernetes.MustCreateCASignedCertSecret(t, "gateway-conformance-infra", "tls-with-san-certificate", []string{"abc.example.com", "spiffe://abc.example.com/test-identity"}, ca, caPrivKey)
+		suite.Applier.MustApplyObjectsWithCleanup(t, suite.Client, suite.TimeoutConfig, []client.Object{secret}, suite.Cleanup)
 
 		tlog.Logf(t, "Test Setup: Ensuring Gateways and Pods from base manifests are ready")
 		namespaces := []string{
diff --git a/examples/experimental/backend-tls.yaml b/examples/experimental/backend-tls.yaml
new file mode 100644
index 00000000..94b8be09
--- /dev/null
+++ b/examples/experimental/backend-tls.yaml
@@ -0,0 +1,18 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: backend-tls
+spec:
+  gatewayClassName: acme-lb
+  tls:
+    backend:
+      clientCertificateRef:
+        kind: Secret
+        group: ""
+        name: foo-example-cert
+  listeners:
+  - name: foo-https
+    protocol: HTTP
+    port: 80
+    hostname: foo.example.com
+---
diff --git a/examples/experimental/frontend-cert-validation.yaml b/examples/experimental/frontend-cert-validation.yaml
index a7a9d4a1..34ada262 100644
--- a/examples/experimental/frontend-cert-validation.yaml
+++ b/examples/experimental/frontend-cert-validation.yaml
@@ -5,12 +5,22 @@ metadata:
 spec:
   gatewayClassName: acme-lb
   tls:
-    default:
-      frontendValidation:
-        caCertificateRefs:
-        - kind: ConfigMap
-          group: ""
-          name: foo-example-com-ca-cert
+    frontend:
+      default:
+        validation:
+          caCertificateRefs:
+          - kind: ConfigMap
+            group: ""
+            name: foo-example-com-ca-cert
+      perPort:
+      - port: 8443
+        tls:
+          validation:
+            caCertificateRefs:
+            - kind: ConfigMap
+              group: ""
+              name: foo-example-com-ca-cert
+            mode: "AllowInsecureFallback"
   listeners:
   - name: foo-https
     protocol: HTTPS
@@ -21,5 +31,14 @@ spec:
       - kind: Secret
         group: ""
         name: foo-example-com-cert
+  - name: bar-https
+    protocol: HTTPS
+    port: 8443
+    hostname: bar.example.com
+    tls:
+      certificateRefs:
+      - kind: Secret
+        group: ""
+        name: bar-example-com-cert
 ---
 
diff --git a/geps/gep-3155/index.md b/geps/gep-3155/index.md
index b75b64cc..41477c22 100644
--- a/geps/gep-3155/index.md
+++ b/geps/gep-3155/index.md
@@ -43,13 +43,20 @@ Specifying credentials at the gateway level is the default operation mode, where
 backends will be presented with a single gateway certificate. Per-service overrides are
 subject for consideration as the future work.
 
-**1. Add a new `BackendTLS` field at the top level of Gateways**
+**1. Add a new `BackendValidation` field at TLSConfig struct located in GatewayTLSConfig.Default field**
 
 ```go
-type GatewaySpec struct {
-  // BackendTLS configures TLS settings for when this Gateway is connecting to
-  // backends with TLS.
-  BackendTLS GatewayBackendTLS `json:"backendTLS,omitempty"'`
+// TLSConfig describes TLS configuration that can apply to multiple Listeners
+// within this Gateway.
+type TLSConfig struct {
+    ...
+	// GatewayBackendTLS describes TLS configuration for gateway when connecting
+	// to backends.
+	// Support: Core
+	//
+	// +optional
+	// <gateway:experimental>
+	BackendValidation *GatewayBackendTLS `json:"backendValidation,omitempty"`
 }
 type GatewayBackendTLS struct {
   // ClientCertificateRef is a reference to an object that contains a Client
diff --git a/pkg/features/backendtlspolicy.go b/pkg/features/backendtlspolicy.go
index 95d50171..12c6a24c 100644
--- a/pkg/features/backendtlspolicy.go
+++ b/pkg/features/backendtlspolicy.go
@@ -25,6 +25,9 @@ import "k8s.io/apimachinery/pkg/util/sets"
 const (
 	// This option indicates support for BackendTLSPolicy.
 	SupportBackendTLSPolicy FeatureName = "BackendTLSPolicy"
+
+	// This option indicates support for BackendTLSPolicy SubjectAltName Validation.
+	SupportBackendTLSPolicySANValidation FeatureName = "BackendTLSPolicySANValidation"
 )
 
 // TLSRouteFeature contains metadata for the TLSRoute feature.
@@ -33,8 +36,21 @@ var BackendTLSPolicyFeature = Feature{
 	Channel: FeatureChannelExperimental,
 }
 
+// BackendTLSPolicySanValidationFeature contains metadata for the BackendTLSPolicy
+// SubjectAltName Validation feature.
+var BackendTLSPolicySanValidationFeature = Feature{
+	Name:    SupportBackendTLSPolicySANValidation,
+	Channel: FeatureChannelExperimental,
+}
+
 // BackendTLSPolicyCoreFeatures includes all the supported features for the
 // BackendTLSPolicy API at a Core level of support.
 var BackendTLSPolicyCoreFeatures = sets.New(
 	BackendTLSPolicyFeature,
 )
+
+// BackendTLSPolicyExtendedFeatures includes all the supported features for the
+// BackendTLSPolicy API at a Extended level of support.
+var BackendTLSPolicyExtendedFeatures = sets.New(
+	BackendTLSPolicySanValidationFeature,
+)
diff --git a/pkg/generated/openapi/zz_generated.openapi.go b/pkg/generated/openapi/zz_generated.openapi.go
index 588319b3..1451e17d 100644
--- a/pkg/generated/openapi/zz_generated.openapi.go
+++ b/pkg/generated/openapi/zz_generated.openapi.go
@@ -90,6 +90,7 @@ func GetOpenAPIDefinitions(ref common.ReferenceCallback) map[string]common.OpenA
 		"sigs.k8s.io/gateway-api/apis/v1.CookieConfig":                                    schema_sigsk8sio_gateway_api_apis_v1_CookieConfig(ref),
 		"sigs.k8s.io/gateway-api/apis/v1.ForwardBodyConfig":                               schema_sigsk8sio_gateway_api_apis_v1_ForwardBodyConfig(ref),
 		"sigs.k8s.io/gateway-api/apis/v1.Fraction":                                        schema_sigsk8sio_gateway_api_apis_v1_Fraction(ref),
+		"sigs.k8s.io/gateway-api/apis/v1.FrontendTLSConfig":                               schema_sigsk8sio_gateway_api_apis_v1_FrontendTLSConfig(ref),
 		"sigs.k8s.io/gateway-api/apis/v1.FrontendTLSValidation":                           schema_sigsk8sio_gateway_api_apis_v1_FrontendTLSValidation(ref),
 		"sigs.k8s.io/gateway-api/apis/v1.GRPCAuthConfig":                                  schema_sigsk8sio_gateway_api_apis_v1_GRPCAuthConfig(ref),
 		"sigs.k8s.io/gateway-api/apis/v1.GRPCBackendRef":                                  schema_sigsk8sio_gateway_api_apis_v1_GRPCBackendRef(ref),
@@ -3113,6 +3114,51 @@ func schema_sigsk8sio_gateway_api_apis_v1_Fraction(ref common.ReferenceCallback)
 	}
 }
 
+func schema_sigsk8sio_gateway_api_apis_v1_FrontendTLSConfig(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "FrontendTLSConfig specifies frontend tls configuration for gateway.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"default": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Default specifies the default client certificate validation configuration for all Listeners handling HTTPS traffic, unless a per-port configuration is defined.\n\nsupport: Core\n\n<gateway:experimental>",
+							Default:     map[string]interface{}{},
+							Ref:         ref("sigs.k8s.io/gateway-api/apis/v1.TLSConfig"),
+						},
+					},
+					"perPort": {
+						VendorExtensible: spec.VendorExtensible{
+							Extensions: spec.Extensions{
+								"x-kubernetes-list-map-keys": []interface{}{
+									"port",
+								},
+								"x-kubernetes-list-type": "map",
+							},
+						},
+						SchemaProps: spec.SchemaProps{
+							Description: "PerPort specifies tls configuration assigned per port. Per port configuration is optional. Once set this configuration overrides the default configuration for all Listeners handling HTTPS traffic that match this port. Each override port requires a unique TLS configuration.\n\nsupport: Core\n\n<gateway:experimental>",
+							Type:        []string{"array"},
+							Items: &spec.SchemaOrArray{
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Default: map[string]interface{}{},
+										Ref:     ref("sigs.k8s.io/gateway-api/apis/v1.TLSPortConfig"),
+									},
+								},
+							},
+						},
+					},
+				},
+				Required: []string{"default"},
+			},
+		},
+		Dependencies: []string{
+			"sigs.k8s.io/gateway-api/apis/v1.TLSConfig", "sigs.k8s.io/gateway-api/apis/v1.TLSPortConfig"},
+	}
+}
+
 func schema_sigsk8sio_gateway_api_apis_v1_FrontendTLSValidation(ref common.ReferenceCallback) common.OpenAPIDefinition {
 	return common.OpenAPIDefinition{
 		Schema: spec.Schema{
@@ -3779,7 +3825,7 @@ func schema_sigsk8sio_gateway_api_apis_v1_GatewayBackendTLS(ref common.Reference
 				Properties: map[string]spec.Schema{
 					"clientCertificateRef": {
 						SchemaProps: spec.SchemaProps{
-							Description: "ClientCertificateRef is a reference to an object that contains a Client Certificate and the associated private key.\n\nReferences to a resource in different namespace are invalid UNLESS there is a ReferenceGrant in the target namespace that allows the certificate to be attached. If a ReferenceGrant does not allow this reference, the \"ResolvedRefs\" condition MUST be set to False for this listener with the \"RefNotPermitted\" reason.\n\nClientCertificateRef can reference to standard Kubernetes resources, i.e. Secret, or implementation-specific custom resources.\n\nThis setting can be overridden on the service level by use of BackendTLSPolicy.\n\nSupport: Core\n\n<gateway:experimental>",
+							Description: "ClientCertificateRef is a reference to an object that contains a Client Certificate and the associated private key.\n\nReferences to a resource in different namespace are invalid UNLESS there is a ReferenceGrant in the target namespace that allows the certificate to be attached. If a ReferenceGrant does not allow this reference, the \"ResolvedRefs\" condition MUST be set to False for this listener with the \"RefNotPermitted\" reason.\n\nClientCertificateRef can reference to standard Kubernetes resources, i.e. Secret, or implementation-specific custom resources.\n\nSupport: Core\n\n<gateway:experimental>",
 							Ref:         ref("sigs.k8s.io/gateway-api/apis/v1.SecretObjectReference"),
 						},
 					},
@@ -4149,12 +4195,6 @@ func schema_sigsk8sio_gateway_api_apis_v1_GatewaySpec(ref common.ReferenceCallba
 							Ref:         ref("sigs.k8s.io/gateway-api/apis/v1.GatewayInfrastructure"),
 						},
 					},
-					"backendTLS": {
-						SchemaProps: spec.SchemaProps{
-							Description: "BackendTLS configures TLS settings for when this Gateway is connecting to backends with TLS.\n\nSupport: Core\n\n<gateway:experimental>",
-							Ref:         ref("sigs.k8s.io/gateway-api/apis/v1.GatewayBackendTLS"),
-						},
-					},
 					"allowedListeners": {
 						SchemaProps: spec.SchemaProps{
 							Description: "AllowedListeners defines which ListenerSets can be attached to this Gateway. While this feature is experimental, the default value is to allow no ListenerSets.\n\n<gateway:experimental>",
@@ -4163,7 +4203,7 @@ func schema_sigsk8sio_gateway_api_apis_v1_GatewaySpec(ref common.ReferenceCallba
 					},
 					"tls": {
 						SchemaProps: spec.SchemaProps{
-							Description: "GatewayTLSConfig specifies frontend tls configuration for gateway.\n\nSupport: Extended\n\n<gateway:experimental>",
+							Description: "TLS specifies frontend and backend tls configuration for entire gateway.\n\nSupport: Extended\n\n<gateway:experimental>",
 							Ref:         ref("sigs.k8s.io/gateway-api/apis/v1.GatewayTLSConfig"),
 						},
 					},
@@ -4172,7 +4212,7 @@ func schema_sigsk8sio_gateway_api_apis_v1_GatewaySpec(ref common.ReferenceCallba
 			},
 		},
 		Dependencies: []string{
-			"sigs.k8s.io/gateway-api/apis/v1.AllowedListeners", "sigs.k8s.io/gateway-api/apis/v1.GatewayBackendTLS", "sigs.k8s.io/gateway-api/apis/v1.GatewayInfrastructure", "sigs.k8s.io/gateway-api/apis/v1.GatewaySpecAddress", "sigs.k8s.io/gateway-api/apis/v1.GatewayTLSConfig", "sigs.k8s.io/gateway-api/apis/v1.Listener"},
+			"sigs.k8s.io/gateway-api/apis/v1.AllowedListeners", "sigs.k8s.io/gateway-api/apis/v1.GatewayInfrastructure", "sigs.k8s.io/gateway-api/apis/v1.GatewaySpecAddress", "sigs.k8s.io/gateway-api/apis/v1.GatewayTLSConfig", "sigs.k8s.io/gateway-api/apis/v1.Listener"},
 	}
 }
 
@@ -4314,44 +4354,26 @@ func schema_sigsk8sio_gateway_api_apis_v1_GatewayTLSConfig(ref common.ReferenceC
 	return common.OpenAPIDefinition{
 		Schema: spec.Schema{
 			SchemaProps: spec.SchemaProps{
-				Description: "GatewayTLSConfig specifies frontend tls configuration for gateway.",
+				Description: "GatewayTLSConfig specifies frontend and backend tls configuration for gateway.",
 				Type:        []string{"object"},
 				Properties: map[string]spec.Schema{
-					"default": {
+					"backend": {
 						SchemaProps: spec.SchemaProps{
-							Description: "Default specifies the default client certificate validation configuration for all Listeners handling HTTPS traffic, unless a per-port configuration is defined.\n\nsupport: Core\n\n<gateway:experimental>",
-							Default:     map[string]interface{}{},
-							Ref:         ref("sigs.k8s.io/gateway-api/apis/v1.TLSConfig"),
+							Description: "Backend describes TLS configuration for gateway when connecting to backends.\n\nNote that this contains only details for the Gateway as a TLS client, and does _not_ imply behavior about how to choose which backend should get a TLS connection. That is determined by the presence of a BackendTLSPolicy.\n\nSupport: Core\n\n<gateway:experimental>",
+							Ref:         ref("sigs.k8s.io/gateway-api/apis/v1.GatewayBackendTLS"),
 						},
 					},
-					"perPort": {
-						VendorExtensible: spec.VendorExtensible{
-							Extensions: spec.Extensions{
-								"x-kubernetes-list-map-keys": []interface{}{
-									"port",
-								},
-								"x-kubernetes-list-type": "map",
-							},
-						},
+					"frontend": {
 						SchemaProps: spec.SchemaProps{
-							Description: "PerPort specifies tls configuration assigned per port. Per port configuration is optional. Once set this configuration overrides the default configuration for all Listeners handling HTTPS traffic that match this port. Each override port requires a unique TLS configuration.\n\nsupport: Core\n\n<gateway:experimental>",
-							Type:        []string{"array"},
-							Items: &spec.SchemaOrArray{
-								Schema: &spec.Schema{
-									SchemaProps: spec.SchemaProps{
-										Default: map[string]interface{}{},
-										Ref:     ref("sigs.k8s.io/gateway-api/apis/v1.TLSPortConfig"),
-									},
-								},
-							},
+							Description: "Frontend describes TLS config when client connects to Gateway. Support: Core\n\n<gateway:experimental>",
+							Ref:         ref("sigs.k8s.io/gateway-api/apis/v1.FrontendTLSConfig"),
 						},
 					},
 				},
-				Required: []string{"default"},
 			},
 		},
 		Dependencies: []string{
-			"sigs.k8s.io/gateway-api/apis/v1.TLSConfig", "sigs.k8s.io/gateway-api/apis/v1.TLSPortConfig"},
+			"sigs.k8s.io/gateway-api/apis/v1.FrontendTLSConfig", "sigs.k8s.io/gateway-api/apis/v1.GatewayBackendTLS"},
 	}
 }
 
@@ -6230,15 +6252,13 @@ func schema_sigsk8sio_gateway_api_apis_v1_TLSConfig(ref common.ReferenceCallback
 				Description: "TLSConfig describes TLS configuration that can apply to multiple Listeners within this Gateway. Currently, it stores only the client certificate validation configuration, but this may be extended in the future.",
 				Type:        []string{"object"},
 				Properties: map[string]spec.Schema{
-					"frontendValidation": {
+					"validation": {
 						SchemaProps: spec.SchemaProps{
-							Description: "FrontendValidation holds configuration information for validating the frontend (client). Setting this field will result in mutual authentication when connecting to the gateway. In browsers this may result in a dialog appearing that requests a user to specify the client certificate. The maximum depth of a certificate chain accepted in verification is Implementation specific.\n\nSupport: Core\n\n<gateway:experimental>",
-							Default:     map[string]interface{}{},
+							Description: "Validation holds configuration information for validating the frontend (client). Setting this field will result in mutual authentication when connecting to the gateway. In browsers this may result in a dialog appearing that requests a user to specify the client certificate. The maximum depth of a certificate chain accepted in verification is Implementation specific.\n\nSupport: Core\n\n<gateway:experimental>",
 							Ref:         ref("sigs.k8s.io/gateway-api/apis/v1.FrontendTLSValidation"),
 						},
 					},
 				},
-				Required: []string{"frontendValidation"},
 			},
 		},
 		Dependencies: []string{
diff --git a/site-src/implementations.md b/site-src/implementations.md
index 0d97e764..dc12477c 100644
--- a/site-src/implementations.md
+++ b/site-src/implementations.md
@@ -205,7 +205,7 @@ Airlock Microgateway protects your applications and microservices with the tried
 
 #### Features
 - Comprehensive WAAP (formerly known as WAF) with security features like Deny Rules to protect against known attacks (OWASP Top 10), header filtering, JSON parsing, OpenAPI specification enforcement, and GraphQL schema validation
-- Identity aware proxy which makes it possible to enforce authentication using JWT authentication or OIDC
+- Identity aware proxy which makes it possible to enforce authentication using JWT authentication or OIDC, with OAuth 2.0 Token Introspection and Token Exchange for continuous validation and secure delegation across services
 - Reverse proxy functionality with request routing rules, TLS termination and remote IP extraction
 - Easy-to-use Grafana dashboards which provide valuable insights in allowed and blocked traffic and other metrics
 
diff --git a/site-src/implementations/v1.1.md b/site-src/implementations/v1.1.md
index 21063b28..69a3326b 100644
--- a/site-src/implementations/v1.1.md
+++ b/site-src/implementations/v1.1.md
@@ -19,13 +19,14 @@ Implementations only appear in this page if they pass Core conformance for the r
 | Organization    | Project                            | Version            | Mode                             | Gateway Port 8080   | HTTPRoute Host Rewrite   | HTTPRoute Path Redirect   | HTTPRoute Request Mirror   | HTTPRoute Response Header Modification   | HTTPRoute Scheme Redirect   | HTTPRoute Method Matching   | HTTPRoute Path Rewrite   | HTTPRoute Query Param Matching   | HTTPRoute Port Redirect   | HTTPRoute Parent Ref Port   | Gateway HTTP Listener Isolation   | Gateway Static Addresses   | HTTPRoute Backend Protocol H2C   | HTTPRoute Backend Protocol Web Socket   | HTTPRoute Backend Request Header Modification   | HTTPRoute Backend Timeout   | HTTPRoute Request Multiple Mirrors   | HTTPRoute Request Timeout   |
 |:----------------|:-----------------------------------|:-------------------|:---------------------------------|:--------------------|:-------------------------|:--------------------------|:---------------------------|:-----------------------------------------|:----------------------------|:----------------------------|:-------------------------|:---------------------------------|:--------------------------|:----------------------------|:----------------------------------|:---------------------------|:---------------------------------|:----------------------------------------|:------------------------------------------------|:----------------------------|:-------------------------------------|:----------------------------|
 | GKE             | gke-gateway                        | 1.30.3-gke.1211000 | gke-l7-global-external-managed   | :white_check_mark:  | :white_check_mark:       | :white_check_mark:        | :white_check_mark:         | :white_check_mark:                       | :white_check_mark:          | :x:                         | :x:                      | :x:                              | :x:                       | :x:                         | :x:                               | :x:                        | :x:                              | :x:                                     | :x:                                             | :x:                         | :x:                                  | :x:                         |
-| GKE             | gke-gateway                        | 1.30.3-gke.1211000 | gke-l7-regional-external-managed | :white_check_mark:  | :white_check_mark:       | :white_check_mark:        | :white_check_mark:         | :white_check_mark:                       | :white_check_mark:          | :x:                         | :x:                      | :x:                              | :x:                       | :x:                         | :x:                               | :x:                        | :x:                              | :x:                                     | :x:                                             | :x:                         | :x:                                  | :x:                         |
 | GKE             | gke-gateway                        | 1.30.3-gke.1211000 | gke-l7-rilb                      | :white_check_mark:  | :white_check_mark:       | :white_check_mark:        | :white_check_mark:         | :white_check_mark:                       | :white_check_mark:          | :x:                         | :x:                      | :x:                              | :x:                       | :x:                         | :x:                               | :x:                        | :x:                              | :x:                                     | :x:                                             | :x:                         | :x:                                  | :x:                         |
+| GKE             | gke-gateway                        | 1.30.3-gke.1211000 | gke-l7-regional-external-managed | :white_check_mark:  | :white_check_mark:       | :white_check_mark:        | :white_check_mark:         | :white_check_mark:                       | :white_check_mark:          | :x:                         | :x:                      | :x:                              | :x:                       | :x:                         | :x:                               | :x:                        | :x:                              | :x:                                     | :x:                                             | :x:                         | :x:                                  | :x:                         |
 | Kong            | kubernetes-ingress-controller      | v3.2.0             | expressions                      | :x:                 | :white_check_mark:       | :x:                       | :x:                        | :white_check_mark:                       | :x:                         | :white_check_mark:          | :white_check_mark:       | :white_check_mark:               | :x:                       | :x:                         | :x:                               | :x:                        | :x:                              | :x:                                     | :x:                                             | :x:                         | :x:                                  | :x:                         |
 | Kong            | kubernetes-ingress-controller      | v3.3.1             | expressions                      | :x:                 | :white_check_mark:       | :x:                       | :x:                        | :white_check_mark:                       | :x:                         | :white_check_mark:          | :white_check_mark:       | :white_check_mark:               | :x:                       | :x:                         | :x:                               | :x:                        | :x:                              | :x:                                     | :x:                                             | :x:                         | :x:                                  | :x:                         |
 | Microsoft Azure | Application Gateway for Containers | 1.3.7              | default                          | :x:                 | :white_check_mark:       | :white_check_mark:        | :x:                        | :white_check_mark:                       | :white_check_mark:          | :white_check_mark:          | :white_check_mark:       | :white_check_mark:               | :white_check_mark:        | :x:                         | :x:                               | :x:                        | :x:                              | :x:                                     | :x:                                             | :x:                         | :x:                                  | :x:                         |
 | airlock         | microgateway                       | 4.5.0              | default                          | :white_check_mark:  | :white_check_mark:       | :white_check_mark:        | :x:                        | :white_check_mark:                       | :white_check_mark:          | :white_check_mark:          | :white_check_mark:       | :white_check_mark:               | :white_check_mark:        | :white_check_mark:          | :x:                               | :x:                        | :x:                              | :x:                                     | :x:                                             | :x:                         | :x:                                  | :x:                         |
 | airlock         | microgateway                       | 4.6.0              | default                          | :white_check_mark:  | :white_check_mark:       | :white_check_mark:        | :x:                        | :white_check_mark:                       | :white_check_mark:          | :white_check_mark:          | :white_check_mark:       | :white_check_mark:               | :white_check_mark:        | :white_check_mark:          | :x:                               | :x:                        | :x:                              | :x:                                     | :x:                                             | :x:                         | :x:                                  | :x:                         |
+| airlock         | microgateway                       | 4.7.0              | default                          | :white_check_mark:  | :white_check_mark:       | :white_check_mark:        | :x:                        | :white_check_mark:                       | :white_check_mark:          | :white_check_mark:          | :white_check_mark:       | :white_check_mark:               | :white_check_mark:        | :white_check_mark:          | :x:                               | :x:                        | :x:                              | :x:                                     | :x:                                             | :x:                         | :x:                                  | :x:                         |
 | airlock         | microgateway                       | v4.4.0             | default                          | :white_check_mark:  | :white_check_mark:       | :white_check_mark:        | :x:                        | :white_check_mark:                       | :white_check_mark:          | :white_check_mark:          | :white_check_mark:       | :white_check_mark:               | :white_check_mark:        | :white_check_mark:          | :x:                               | :x:                        | :x:                              | :x:                                     | :x:                                             | :x:                         | :x:                                  | :x:                         |
 | cilium          | cilium                             | v1.16.0            | default                          | :white_check_mark:  | :white_check_mark:       | :white_check_mark:        | :white_check_mark:         | :white_check_mark:                       | :white_check_mark:          | :white_check_mark:          | :white_check_mark:       | :white_check_mark:               | :white_check_mark:        | :white_check_mark:          | :white_check_mark:                | :white_check_mark:         | :white_check_mark:               | :white_check_mark:                      | :white_check_mark:                              | :white_check_mark:          | :white_check_mark:                   | :white_check_mark:          |
 | envoyproxy      | envoy-gateway                      | v1.1.0             | default                          | :white_check_mark:  | :white_check_mark:       | :white_check_mark:        | :white_check_mark:         | :white_check_mark:                       | :white_check_mark:          | :white_check_mark:          | :white_check_mark:       | :white_check_mark:               | :white_check_mark:        | :white_check_mark:          | :white_check_mark:                | :white_check_mark:         | :x:                              | :x:                                     | :white_check_mark:                              | :white_check_mark:          | :white_check_mark:                   | :white_check_mark:          |
diff --git a/site-src/implementations/v1.2.md b/site-src/implementations/v1.2.md
index c26434b4..a3728f6a 100644
--- a/site-src/implementations/v1.2.md
+++ b/site-src/implementations/v1.2.md
@@ -16,32 +16,39 @@ Implementations only appear in this page if they pass Core conformance for the r
 
 ### HTTPRoute
 
-| Organization   | Project                       | Version   | Mode                   | HTTPRoute Host Rewrite   | HTTPRoute Path Rewrite   | HTTPRoute Response Header Modification   | HTTPRoute Method Matching   | HTTPRoute Query Param Matching   | Gateway Infrastructure Propagation   | Gateway Port 8080   | HTTPRoute Backend Protocol H2C   | HTTPRoute Backend Protocol Web Socket   | HTTPRoute Backend Timeout   | HTTPRoute Destination Port Matching   | HTTPRoute Parent Ref Port   | HTTPRoute Port Redirect   | HTTPRoute Request Timeout   | HTTPRoute Scheme Redirect   | HTTPRoute Path Redirect   | Gateway HTTP Listener Isolation   | Gateway Static Addresses   | HTTPRoute Backend Request Header Modification   | HTTPRoute Request Mirror   | HTTPRoute Request Multiple Mirrors   |
-|:---------------|:------------------------------|:----------|:-----------------------|:-------------------------|:-------------------------|:-----------------------------------------|:----------------------------|:---------------------------------|:-------------------------------------|:--------------------|:---------------------------------|:----------------------------------------|:----------------------------|:--------------------------------------|:----------------------------|:--------------------------|:----------------------------|:----------------------------|:--------------------------|:----------------------------------|:---------------------------|:------------------------------------------------|:---------------------------|:-------------------------------------|
-| Kong           | kubernetes-ingress-controller | v3.4.0    | traditional_compatible | :white_check_mark:       | :white_check_mark:       | :white_check_mark:                       | :white_check_mark:          | :white_check_mark:               | :x:                                  | :x:                 | :x:                              | :x:                                     | :x:                         | :x:                                   | :x:                         | :x:                       | :x:                         | :x:                         | :x:                       | :x:                               | :x:                        | :x:                                             | :x:                        | :x:                                  |
-| Kong           | kubernetes-ingress-controller | v3.4.0    | expressions            | :white_check_mark:       | :white_check_mark:       | :white_check_mark:                       | :white_check_mark:          | :white_check_mark:               | :x:                                  | :x:                 | :x:                              | :x:                                     | :x:                         | :x:                                   | :x:                         | :x:                       | :x:                         | :x:                         | :x:                       | :x:                               | :x:                        | :x:                                             | :x:                        | :x:                                  |
-| airlock        | microgateway                  | 4.5.0     | default                | :white_check_mark:       | :white_check_mark:       | :white_check_mark:                       | :white_check_mark:          | :white_check_mark:               | :white_check_mark:                   | :white_check_mark:  | :white_check_mark:               | :white_check_mark:                      | :white_check_mark:          | :white_check_mark:                    | :white_check_mark:          | :white_check_mark:        | :white_check_mark:          | :white_check_mark:          | :white_check_mark:        | :x:                               | :x:                        | :x:                                             | :x:                        | :x:                                  |
-| airlock        | microgateway                  | 4.6.0     | default                | :white_check_mark:       | :white_check_mark:       | :white_check_mark:                       | :white_check_mark:          | :white_check_mark:               | :white_check_mark:                   | :white_check_mark:  | :white_check_mark:               | :white_check_mark:                      | :white_check_mark:          | :white_check_mark:                    | :white_check_mark:          | :white_check_mark:        | :white_check_mark:          | :white_check_mark:          | :white_check_mark:        | :x:                               | :x:                        | :x:                                             | :x:                        | :x:                                  |
-| cilium         | cilium                        | v1.17     | default                | :white_check_mark:       | :white_check_mark:       | :white_check_mark:                       | :white_check_mark:          | :white_check_mark:               | :white_check_mark:                   | :white_check_mark:  | :white_check_mark:               | :white_check_mark:                      | :white_check_mark:          | :white_check_mark:                    | :x:                         | :white_check_mark:        | :white_check_mark:          | :white_check_mark:          | :white_check_mark:        | :white_check_mark:                | :white_check_mark:         | :white_check_mark:                              | :white_check_mark:         | :white_check_mark:                   |
-| envoyproxy     | envoy-gateway                 | latest    | default                | :white_check_mark:       | :white_check_mark:       | :white_check_mark:                       | :white_check_mark:          | :white_check_mark:               | :x:                                  | :white_check_mark:  | :white_check_mark:               | :white_check_mark:                      | :white_check_mark:          | :white_check_mark:                    | :white_check_mark:          | :white_check_mark:        | :white_check_mark:          | :white_check_mark:          | :white_check_mark:        | :white_check_mark:                | :x:                        | :white_check_mark:                              | :white_check_mark:         | :white_check_mark:                   |
-| istio          | istio                         | 1.24      | default                | :white_check_mark:       | :white_check_mark:       | :white_check_mark:                       | :white_check_mark:          | :white_check_mark:               | :white_check_mark:                   | :white_check_mark:  | :white_check_mark:               | :white_check_mark:                      | :white_check_mark:          | :white_check_mark:                    | :white_check_mark:          | :white_check_mark:        | :white_check_mark:          | :white_check_mark:          | :white_check_mark:        | :white_check_mark:                | :white_check_mark:         | :white_check_mark:                              | :white_check_mark:         | :white_check_mark:                   |
-| kgateway-dev   | kgateway                      | v2.0.0    | default                | :white_check_mark:       | :white_check_mark:       | :white_check_mark:                       | :white_check_mark:          | :white_check_mark:               | :x:                                  | :x:                 | :white_check_mark:               | :x:                                     | :x:                         | :x:                                   | :x:                         | :white_check_mark:        | :x:                         | :white_check_mark:          | :white_check_mark:        | :x:                               | :x:                        | :x:                                             | :white_check_mark:         | :x:                                  |
-| nginx          | nginx-gateway-fabric          | v1.6.0    | default                | :white_check_mark:       | :white_check_mark:       | :white_check_mark:                       | :white_check_mark:          | :white_check_mark:               | :x:                                  | :white_check_mark:  | :x:                              | :x:                                     | :x:                         | :x:                                   | :x:                         | :white_check_mark:        | :x:                         | :white_check_mark:          | :white_check_mark:        | :x:                               | :x:                        | :x:                                             | :x:                        | :x:                                  |
-| projectcontour | contour                       | v1.31.0   | default                | :white_check_mark:       | :white_check_mark:       | :white_check_mark:                       | :white_check_mark:          | :white_check_mark:               | :white_check_mark:                   | :white_check_mark:  | :white_check_mark:               | :white_check_mark:                      | :white_check_mark:          | :white_check_mark:                    | :white_check_mark:          | :white_check_mark:        | :white_check_mark:          | :white_check_mark:          | :white_check_mark:        | :white_check_mark:                | :white_check_mark:         | :white_check_mark:                              | :white_check_mark:         | :white_check_mark:                   |
-| traefik        | traefik                       | v3.2.2    | default                | :white_check_mark:       | :white_check_mark:       | :white_check_mark:                       | :white_check_mark:          | :white_check_mark:               | :x:                                  | :white_check_mark:  | :white_check_mark:               | :white_check_mark:                      | :x:                         | :white_check_mark:                    | :x:                         | :white_check_mark:        | :x:                         | :white_check_mark:          | :white_check_mark:        | :x:                               | :x:                        | :x:                                             | :x:                        | :x:                                  |
+| Organization    | Project                            | Version   | Mode                   | HTTPRoute Host Rewrite   | HTTPRoute Method Matching   | HTTPRoute Path Rewrite   | HTTPRoute Query Param Matching   | HTTPRoute Response Header Modification   | HTTPRoute Destination Port Matching   | HTTPRoute Path Redirect   | HTTPRoute Port Redirect   | HTTPRoute Scheme Redirect   | Gateway Infrastructure Propagation   | Gateway Port 8080   | HTTPRoute Backend Protocol H2C   | HTTPRoute Backend Protocol Web Socket   | HTTPRoute Backend Timeout   | HTTPRoute Parent Ref Port   | HTTPRoute Request Timeout   | Gateway HTTP Listener Isolation   | Gateway Static Addresses   | HTTPRoute Backend Request Header Modification   | HTTPRoute Request Mirror   | HTTPRoute Request Multiple Mirrors   |
+|:----------------|:-----------------------------------|:----------|:-----------------------|:-------------------------|:----------------------------|:-------------------------|:---------------------------------|:-----------------------------------------|:--------------------------------------|:--------------------------|:--------------------------|:----------------------------|:-------------------------------------|:--------------------|:---------------------------------|:----------------------------------------|:----------------------------|:----------------------------|:----------------------------|:----------------------------------|:---------------------------|:------------------------------------------------|:---------------------------|:-------------------------------------|
+| Kong            | kubernetes-ingress-controller      | v3.4.0    | expressions            | :white_check_mark:       | :white_check_mark:          | :white_check_mark:       | :white_check_mark:               | :white_check_mark:                       | :x:                                   | :x:                       | :x:                       | :x:                         | :x:                                  | :x:                 | :x:                              | :x:                                     | :x:                         | :x:                         | :x:                         | :x:                               | :x:                        | :x:                                             | :x:                        | :x:                                  |
+| Kong            | kubernetes-ingress-controller      | v3.4.0    | traditional_compatible | :white_check_mark:       | :white_check_mark:          | :white_check_mark:       | :white_check_mark:               | :white_check_mark:                       | :x:                                   | :x:                       | :x:                       | :x:                         | :x:                                  | :x:                 | :x:                              | :x:                                     | :x:                         | :x:                         | :x:                         | :x:                               | :x:                        | :x:                                             | :x:                        | :x:                                  |
+| Microsoft Azure | Application Gateway for Containers | 1.7.9     | default                | :white_check_mark:       | :white_check_mark:          | :white_check_mark:       | :white_check_mark:               | :white_check_mark:                       | :white_check_mark:                    | :white_check_mark:        | :white_check_mark:        | :white_check_mark:          | :x:                                  | :x:                 | :x:                              | :x:                                     | :x:                         | :x:                         | :x:                         | :x:                               | :x:                        | :x:                                             | :x:                        | :x:                                  |
+| airlock         | microgateway                       | 4.5.0     | default                | :white_check_mark:       | :white_check_mark:          | :white_check_mark:       | :white_check_mark:               | :white_check_mark:                       | :white_check_mark:                    | :white_check_mark:        | :white_check_mark:        | :white_check_mark:          | :white_check_mark:                   | :white_check_mark:  | :white_check_mark:               | :white_check_mark:                      | :white_check_mark:          | :white_check_mark:          | :white_check_mark:          | :x:                               | :x:                        | :x:                                             | :x:                        | :x:                                  |
+| airlock         | microgateway                       | 4.6.0     | default                | :white_check_mark:       | :white_check_mark:          | :white_check_mark:       | :white_check_mark:               | :white_check_mark:                       | :white_check_mark:                    | :white_check_mark:        | :white_check_mark:        | :white_check_mark:          | :white_check_mark:                   | :white_check_mark:  | :white_check_mark:               | :white_check_mark:                      | :white_check_mark:          | :white_check_mark:          | :white_check_mark:          | :x:                               | :x:                        | :x:                                             | :x:                        | :x:                                  |
+| airlock         | microgateway                       | 4.7.0     | default                | :white_check_mark:       | :white_check_mark:          | :white_check_mark:       | :white_check_mark:               | :white_check_mark:                       | :white_check_mark:                    | :white_check_mark:        | :white_check_mark:        | :white_check_mark:          | :white_check_mark:                   | :white_check_mark:  | :white_check_mark:               | :white_check_mark:                      | :white_check_mark:          | :white_check_mark:          | :white_check_mark:          | :x:                               | :x:                        | :x:                                             | :x:                        | :x:                                  |
+| cilium          | cilium                             | v1.17     | default                | :white_check_mark:       | :white_check_mark:          | :white_check_mark:       | :white_check_mark:               | :white_check_mark:                       | :white_check_mark:                    | :white_check_mark:        | :white_check_mark:        | :white_check_mark:          | :white_check_mark:                   | :white_check_mark:  | :white_check_mark:               | :white_check_mark:                      | :white_check_mark:          | :x:                         | :white_check_mark:          | :white_check_mark:                | :white_check_mark:         | :white_check_mark:                              | :white_check_mark:         | :white_check_mark:                   |
+| envoyproxy      | envoy-gateway                      | latest    | default                | :white_check_mark:       | :white_check_mark:          | :white_check_mark:       | :white_check_mark:               | :white_check_mark:                       | :white_check_mark:                    | :white_check_mark:        | :white_check_mark:        | :white_check_mark:          | :x:                                  | :white_check_mark:  | :white_check_mark:               | :white_check_mark:                      | :white_check_mark:          | :white_check_mark:          | :white_check_mark:          | :white_check_mark:                | :x:                        | :white_check_mark:                              | :white_check_mark:         | :white_check_mark:                   |
+| istio           | istio                              | 1.24      | default                | :white_check_mark:       | :white_check_mark:          | :white_check_mark:       | :white_check_mark:               | :white_check_mark:                       | :white_check_mark:                    | :white_check_mark:        | :white_check_mark:        | :white_check_mark:          | :white_check_mark:                   | :white_check_mark:  | :white_check_mark:               | :white_check_mark:                      | :white_check_mark:          | :white_check_mark:          | :white_check_mark:          | :white_check_mark:                | :white_check_mark:         | :white_check_mark:                              | :white_check_mark:         | :white_check_mark:                   |
+| kgateway-dev    | kgateway                           | v2.0.0    | default                | :white_check_mark:       | :white_check_mark:          | :white_check_mark:       | :white_check_mark:               | :white_check_mark:                       | :x:                                   | :white_check_mark:        | :white_check_mark:        | :white_check_mark:          | :x:                                  | :x:                 | :white_check_mark:               | :x:                                     | :x:                         | :x:                         | :x:                         | :x:                               | :x:                        | :x:                                             | :white_check_mark:         | :x:                                  |
+| kubvernor       | kubvernor                          | 0.1.0     | default                | :x:                      | :x:                         | :x:                      | :x:                              | :x:                                      | :x:                                   | :x:                       | :x:                       | :x:                         | :x:                                  | :x:                 | :x:                              | :x:                                     | :x:                         | :x:                         | :x:                         | :x:                               | :x:                        | :x:                                             | :x:                        | :x:                                  |
+| nginx           | nginx-gateway-fabric               | v1.6.0    | default                | :white_check_mark:       | :white_check_mark:          | :white_check_mark:       | :white_check_mark:               | :white_check_mark:                       | :x:                                   | :white_check_mark:        | :white_check_mark:        | :white_check_mark:          | :white_check_mark:                   | :white_check_mark:  | :x:                              | :x:                                     | :x:                         | :x:                         | :x:                         | :white_check_mark:                | :x:                        | :x:                                             | :white_check_mark:         | :white_check_mark:                   |
+| nginx           | nginx-gateway-fabric               | v2.0.2    | default                | :white_check_mark:       | :white_check_mark:          | :white_check_mark:       | :white_check_mark:               | :white_check_mark:                       | :x:                                   | :white_check_mark:        | :white_check_mark:        | :white_check_mark:          | :white_check_mark:                   | :white_check_mark:  | :x:                              | :x:                                     | :x:                         | :x:                         | :x:                         | :white_check_mark:                | :x:                        | :x:                                             | :white_check_mark:         | :white_check_mark:                   |
+| projectcontour  | contour                            | v1.31.0   | default                | :white_check_mark:       | :white_check_mark:          | :white_check_mark:       | :white_check_mark:               | :white_check_mark:                       | :white_check_mark:                    | :white_check_mark:        | :white_check_mark:        | :white_check_mark:          | :white_check_mark:                   | :white_check_mark:  | :white_check_mark:               | :white_check_mark:                      | :white_check_mark:          | :white_check_mark:          | :white_check_mark:          | :white_check_mark:                | :white_check_mark:         | :white_check_mark:                              | :white_check_mark:         | :white_check_mark:                   |
+| traefik         | traefik                            | v3.2.2    | default                | :white_check_mark:       | :white_check_mark:          | :white_check_mark:       | :white_check_mark:               | :white_check_mark:                       | :white_check_mark:                    | :white_check_mark:        | :white_check_mark:        | :white_check_mark:          | :x:                                  | :white_check_mark:  | :white_check_mark:               | :white_check_mark:                      | :x:                         | :x:                         | :x:                         | :x:                               | :x:                        | :x:                                             | :x:                        | :x:                                  |
 
 ### GRPCRoute
 
-| Organization   | Project                       | Version   | Mode                   | Gateway HTTP Listener Isolation   | Gateway Infrastructure Propagation   | Gateway Port 8080   | Gateway Static Addresses   |
-|:---------------|:------------------------------|:----------|:-----------------------|:----------------------------------|:-------------------------------------|:--------------------|:---------------------------|
-| Kong           | kubernetes-ingress-controller | v3.4.0    | traditional_compatible | :x:                               | :x:                                  | :x:                 | :x:                        |
-| Kong           | kubernetes-ingress-controller | v3.4.0    | expressions            | :x:                               | :x:                                  | :x:                 | :x:                        |
-| cilium         | cilium                        | v1.17     | default                | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :white_check_mark:         |
-| envoyproxy     | envoy-gateway                 | latest    | default                | :x:                               | :x:                                  | :x:                 | :x:                        |
-| istio          | istio                         | 1.24      | default                | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :white_check_mark:         |
-| nginx          | nginx-gateway-fabric          | v1.6.0    | default                | :x:                               | :x:                                  | :x:                 | :x:                        |
-| projectcontour | contour                       | v1.31.0   | default                | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :white_check_mark:         |
-| traefik        | traefik                       | v3.2.2    | default                | :x:                               | :x:                                  | :x:                 | :x:                        |
+| Organization    | Project                            | Version   | Mode                   | Gateway HTTP Listener Isolation   | Gateway Infrastructure Propagation   | Gateway Port 8080   | Gateway Static Addresses   |
+|:----------------|:-----------------------------------|:----------|:-----------------------|:----------------------------------|:-------------------------------------|:--------------------|:---------------------------|
+| Kong            | kubernetes-ingress-controller      | v3.4.0    | expressions            | :x:                               | :x:                                  | :x:                 | :x:                        |
+| Kong            | kubernetes-ingress-controller      | v3.4.0    | traditional_compatible | :x:                               | :x:                                  | :x:                 | :x:                        |
+| Microsoft Azure | Application Gateway for Containers | 1.7.9     | default                | :x:                               | :x:                                  | :x:                 | :x:                        |
+| cilium          | cilium                             | v1.17     | default                | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :white_check_mark:         |
+| envoyproxy      | envoy-gateway                      | latest    | default                | :x:                               | :x:                                  | :x:                 | :x:                        |
+| istio           | istio                              | 1.24      | default                | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :white_check_mark:         |
+| kubvernor       | kubvernor                          | 0.1.0     | default                | :x:                               | :x:                                  | :x:                 | :x:                        |
+| nginx           | nginx-gateway-fabric               | v1.6.0    | default                | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :x:                        |
+| nginx           | nginx-gateway-fabric               | v2.0.2    | default                | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :x:                        |
+| projectcontour  | contour                            | v1.31.0   | default                | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :white_check_mark:         |
+| traefik         | traefik                            | v3.2.2    | default                | :x:                               | :x:                                  | :x:                 | :x:                        |
 
 ### TLSRoute
 
@@ -50,7 +57,8 @@ Implementations only appear in this page if they pass Core conformance for the r
 | cilium         | cilium               | v1.17     | default | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :white_check_mark:         |
 | envoyproxy     | envoy-gateway        | latest    | default | :x:                               | :x:                                  | :x:                 | :x:                        |
 | istio          | istio                | 1.24      | default | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :white_check_mark:         |
-| nginx          | nginx-gateway-fabric | v1.6.0    | default | :x:                               | :x:                                  | :x:                 | :x:                        |
+| nginx          | nginx-gateway-fabric | v1.6.0    | default | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :x:                        |
+| nginx          | nginx-gateway-fabric | v2.0.2    | default | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :x:                        |
 | projectcontour | contour              | v1.31.0   | default | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :white_check_mark:         |
 | traefik        | traefik              | v3.2.2    | default | :x:                               | :x:                                  | :x:                 | :x:                        |
 
diff --git a/site-src/implementations/v1.3.md b/site-src/implementations/v1.3.md
index 552e98cd..653a8b80 100644
--- a/site-src/implementations/v1.3.md
+++ b/site-src/implementations/v1.3.md
@@ -16,34 +16,48 @@ Implementations only appear in this page if they pass Core conformance for the r
 
 ### HTTPRoute
 
-| Organization   | Project       | Version   | Mode    | Gateway Infrastructure Propagation   | Gateway Port 8080   | HTTPRoute Backend Protocol H2C   | HTTPRoute Backend Protocol Web Socket   | HTTPRoute Backend Timeout   | HTTPRoute Destination Port Matching   | HTTPRoute Host Rewrite   | HTTPRoute Method Matching   | HTTPRoute Parent Ref Port   | HTTPRoute Path Redirect   | HTTPRoute Path Rewrite   | HTTPRoute Port Redirect   | HTTPRoute Query Param Matching   | HTTPRoute Request Timeout   | HTTPRoute Response Header Modification   | HTTPRoute Scheme Redirect   | Gateway Address Empty   | Gateway HTTP Listener Isolation   | Gateway Static Addresses   | HTTPRoute Backend Request Header Modification   | HTTPRoute Request Mirror   | HTTPRoute Request Multiple Mirrors   | HTTPRoute Request Percentage Mirror   |
-|:---------------|:--------------|:----------|:--------|:-------------------------------------|:--------------------|:---------------------------------|:----------------------------------------|:----------------------------|:--------------------------------------|:-------------------------|:----------------------------|:----------------------------|:--------------------------|:-------------------------|:--------------------------|:---------------------------------|:----------------------------|:-----------------------------------------|:----------------------------|:------------------------|:----------------------------------|:---------------------------|:------------------------------------------------|:---------------------------|:-------------------------------------|:--------------------------------------|
-| airlock        | microgateway  | 4.6.0     | default | :white_check_mark:                   | :white_check_mark:  | :white_check_mark:               | :white_check_mark:                      | :white_check_mark:          | :white_check_mark:                    | :white_check_mark:       | :white_check_mark:          | :white_check_mark:          | :white_check_mark:        | :white_check_mark:       | :white_check_mark:        | :white_check_mark:               | :white_check_mark:          | :white_check_mark:                       | :white_check_mark:          | :x:                     | :x:                               | :x:                        | :x:                                             | :x:                        | :x:                                  | :x:                                   |
-| cilium         | cilium        | main      | default | :white_check_mark:                   | :white_check_mark:  | :white_check_mark:               | :white_check_mark:                      | :white_check_mark:          | :white_check_mark:                    | :white_check_mark:       | :white_check_mark:          | :x:                         | :white_check_mark:        | :white_check_mark:       | :white_check_mark:        | :white_check_mark:               | :white_check_mark:          | :white_check_mark:                       | :white_check_mark:          | :white_check_mark:      | :white_check_mark:                | :white_check_mark:         | :white_check_mark:                              | :white_check_mark:         | :white_check_mark:                   | :white_check_mark:                    |
-| envoyproxy     | envoy-gateway | latest    | default | :x:                                  | :white_check_mark:  | :white_check_mark:               | :white_check_mark:                      | :white_check_mark:          | :white_check_mark:                    | :white_check_mark:       | :white_check_mark:          | :white_check_mark:          | :white_check_mark:        | :white_check_mark:       | :white_check_mark:        | :white_check_mark:               | :white_check_mark:          | :white_check_mark:                       | :white_check_mark:          | :white_check_mark:      | :white_check_mark:                | :x:                        | :white_check_mark:                              | :white_check_mark:         | :white_check_mark:                   | :white_check_mark:                    |
-| istio          | istio         | 1.26.1    | default | :white_check_mark:                   | :white_check_mark:  | :white_check_mark:               | :white_check_mark:                      | :white_check_mark:          | :white_check_mark:                    | :white_check_mark:       | :white_check_mark:          | :white_check_mark:          | :white_check_mark:        | :white_check_mark:       | :white_check_mark:        | :white_check_mark:               | :white_check_mark:          | :white_check_mark:                       | :white_check_mark:          | :white_check_mark:      | :white_check_mark:                | :white_check_mark:         | :white_check_mark:                              | :white_check_mark:         | :white_check_mark:                   | :white_check_mark:                    |
+| Organization   | Project              | Version     | Mode             | Gateway Address Empty   | Gateway HTTP Listener Isolation   | Gateway Infrastructure Propagation   | Gateway Port 8080   | Gateway Static Addresses   | HTTPRoute Backend Protocol H2C   | HTTPRoute Backend Protocol Web Socket   | HTTPRoute Backend Request Header Modification   | HTTPRoute Backend Timeout   | HTTPRoute Destination Port Matching   | HTTPRoute Host Rewrite   | HTTPRoute Method Matching   | HTTPRoute Parent Ref Port   | HTTPRoute Path Redirect   | HTTPRoute Path Rewrite   | HTTPRoute Port Redirect   | HTTPRoute Query Param Matching   | HTTPRoute Request Mirror   | HTTPRoute Request Multiple Mirrors   | HTTPRoute Request Percentage Mirror   | HTTPRoute Request Timeout   | HTTPRoute Response Header Modification   | HTTPRoute Scheme Redirect   |
+|:---------------|:---------------------|:------------|:-----------------|:------------------------|:----------------------------------|:-------------------------------------|:--------------------|:---------------------------|:---------------------------------|:----------------------------------------|:------------------------------------------------|:----------------------------|:--------------------------------------|:-------------------------|:----------------------------|:----------------------------|:--------------------------|:-------------------------|:--------------------------|:---------------------------------|:---------------------------|:-------------------------------------|:--------------------------------------|:----------------------------|:-----------------------------------------|:----------------------------|
+| agentgateway   | agentgateway         | v0.6.0-dev  | default          | :white_check_mark:      | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :white_check_mark:         | :white_check_mark:               | :white_check_mark:                      | :white_check_mark:                              | :white_check_mark:          | :white_check_mark:                    | :white_check_mark:       | :white_check_mark:          | :white_check_mark:          | :white_check_mark:        | :white_check_mark:       | :white_check_mark:        | :white_check_mark:               | :white_check_mark:         | :white_check_mark:                   | :white_check_mark:                    | :white_check_mark:          | :white_check_mark:                       | :white_check_mark:          |
+| airlock        | microgateway         | 4.6.0       | default          | :x:                     | :x:                               | :white_check_mark:                   | :white_check_mark:  | :x:                        | :white_check_mark:               | :white_check_mark:                      | :x:                                             | :white_check_mark:          | :white_check_mark:                    | :white_check_mark:       | :white_check_mark:          | :white_check_mark:          | :white_check_mark:        | :white_check_mark:       | :white_check_mark:        | :white_check_mark:               | :x:                        | :x:                                  | :x:                                   | :white_check_mark:          | :white_check_mark:                       | :white_check_mark:          |
+| airlock        | microgateway         | 4.7.0       | default          | :x:                     | :x:                               | :white_check_mark:                   | :white_check_mark:  | :x:                        | :white_check_mark:               | :white_check_mark:                      | :x:                                             | :white_check_mark:          | :white_check_mark:                    | :white_check_mark:       | :white_check_mark:          | :white_check_mark:          | :white_check_mark:        | :white_check_mark:       | :white_check_mark:        | :white_check_mark:               | :x:                        | :x:                                  | :x:                                   | :white_check_mark:          | :white_check_mark:                       | :white_check_mark:          |
+| cilium         | cilium               | main        | default          | :white_check_mark:      | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :white_check_mark:         | :white_check_mark:               | :white_check_mark:                      | :white_check_mark:                              | :white_check_mark:          | :white_check_mark:                    | :white_check_mark:       | :white_check_mark:          | :x:                         | :white_check_mark:        | :white_check_mark:       | :white_check_mark:        | :white_check_mark:               | :white_check_mark:         | :white_check_mark:                   | :white_check_mark:                    | :white_check_mark:          | :white_check_mark:                       | :white_check_mark:          |
+| envoyproxy     | envoy-gateway        | v1.5.0      | GatewayNamespace | :white_check_mark:      | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :x:                        | :white_check_mark:               | :white_check_mark:                      | :white_check_mark:                              | :white_check_mark:          | :white_check_mark:                    | :white_check_mark:       | :white_check_mark:          | :white_check_mark:          | :white_check_mark:        | :white_check_mark:       | :white_check_mark:        | :white_check_mark:               | :white_check_mark:         | :white_check_mark:                   | :white_check_mark:                    | :white_check_mark:          | :white_check_mark:                       | :white_check_mark:          |
+| envoyproxy     | envoy-gateway        | v1.5.0      | default          | :white_check_mark:      | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :x:                        | :white_check_mark:               | :white_check_mark:                      | :white_check_mark:                              | :white_check_mark:          | :white_check_mark:                    | :white_check_mark:       | :white_check_mark:          | :white_check_mark:          | :white_check_mark:        | :white_check_mark:       | :white_check_mark:        | :white_check_mark:               | :white_check_mark:         | :white_check_mark:                   | :white_check_mark:                    | :white_check_mark:          | :white_check_mark:                       | :white_check_mark:          |
+| istio          | istio                | 1.26.1      | default          | :white_check_mark:      | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :white_check_mark:         | :white_check_mark:               | :white_check_mark:                      | :white_check_mark:                              | :white_check_mark:          | :white_check_mark:                    | :white_check_mark:       | :white_check_mark:          | :white_check_mark:          | :white_check_mark:        | :white_check_mark:       | :white_check_mark:        | :white_check_mark:               | :white_check_mark:         | :white_check_mark:                   | :white_check_mark:                    | :white_check_mark:          | :white_check_mark:                       | :white_check_mark:          |
+| kgateway-dev   | kgateway             | v2.1.0-main | default          | :x:                     | :x:                               | :x:                                  | :x:                 | :x:                        | :white_check_mark:               | :white_check_mark:                      | :x:                                             | :white_check_mark:          | :x:                                   | :white_check_mark:       | :white_check_mark:          | :x:                         | :white_check_mark:        | :white_check_mark:       | :white_check_mark:        | :white_check_mark:               | :white_check_mark:         | :x:                                  | :x:                                   | :white_check_mark:          | :white_check_mark:                       | :white_check_mark:          |
+| nginx          | nginx-gateway-fabric | v2.0.0      | default          | :white_check_mark:      | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :x:                        | :x:                              | :white_check_mark:                      | :x:                                             | :x:                         | :x:                                   | :white_check_mark:       | :white_check_mark:          | :x:                         | :white_check_mark:        | :white_check_mark:       | :white_check_mark:        | :white_check_mark:               | :white_check_mark:         | :white_check_mark:                   | :white_check_mark:                    | :x:                         | :white_check_mark:                       | :white_check_mark:          |
+| nginx          | nginx-gateway-fabric | v2.1.0      | default          | :white_check_mark:      | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :x:                        | :x:                              | :white_check_mark:                      | :x:                                             | :x:                         | :x:                                   | :white_check_mark:       | :white_check_mark:          | :x:                         | :white_check_mark:        | :white_check_mark:       | :white_check_mark:        | :white_check_mark:               | :white_check_mark:         | :white_check_mark:                   | :white_check_mark:                    | :x:                         | :white_check_mark:                       | :white_check_mark:          |
 
 ### GRPCRoute
 
-| Organization   | Project       | Version   | Mode    | Gateway Address Empty   | Gateway HTTP Listener Isolation   | Gateway Infrastructure Propagation   | Gateway Port 8080   | Gateway Static Addresses   |
-|:---------------|:--------------|:----------|:--------|:------------------------|:----------------------------------|:-------------------------------------|:--------------------|:---------------------------|
-| cilium         | cilium        | main      | default | :white_check_mark:      | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :white_check_mark:         |
-| envoyproxy     | envoy-gateway | latest    | default | :x:                     | :x:                               | :x:                                  | :x:                 | :x:                        |
-| istio          | istio         | 1.26.1    | default | :white_check_mark:      | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :white_check_mark:         |
+| Organization   | Project              | Version   | Mode             | Gateway Address Empty   | Gateway HTTP Listener Isolation   | Gateway Infrastructure Propagation   | Gateway Port 8080   | Gateway Static Addresses   |
+|:---------------|:---------------------|:----------|:-----------------|:------------------------|:----------------------------------|:-------------------------------------|:--------------------|:---------------------------|
+| cilium         | cilium               | main      | default          | :white_check_mark:      | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :white_check_mark:         |
+| envoyproxy     | envoy-gateway        | v1.5.0    | GatewayNamespace | :white_check_mark:      | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :x:                        |
+| envoyproxy     | envoy-gateway        | v1.5.0    | default          | :white_check_mark:      | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :x:                        |
+| istio          | istio                | 1.26.1    | default          | :white_check_mark:      | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :white_check_mark:         |
+| nginx          | nginx-gateway-fabric | v2.0.0    | default          | :white_check_mark:      | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :x:                        |
+| nginx          | nginx-gateway-fabric | v2.1.0    | default          | :white_check_mark:      | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :x:                        |
 
 ### TLSRoute
 
-| Organization   | Project       | Version   | Mode    | Gateway Address Empty   | Gateway HTTP Listener Isolation   | Gateway Infrastructure Propagation   | Gateway Port 8080   | Gateway Static Addresses   |
-|:---------------|:--------------|:----------|:--------|:------------------------|:----------------------------------|:-------------------------------------|:--------------------|:---------------------------|
-| cilium         | cilium        | main      | default | :white_check_mark:      | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :white_check_mark:         |
-| envoyproxy     | envoy-gateway | latest    | default | :x:                     | :x:                               | :x:                                  | :x:                 | :x:                        |
-| istio          | istio         | 1.26.1    | default | :white_check_mark:      | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :white_check_mark:         |
+| Organization   | Project              | Version   | Mode             | Gateway Address Empty   | Gateway HTTP Listener Isolation   | Gateway Infrastructure Propagation   | Gateway Port 8080   | Gateway Static Addresses   |
+|:---------------|:---------------------|:----------|:-----------------|:------------------------|:----------------------------------|:-------------------------------------|:--------------------|:---------------------------|
+| cilium         | cilium               | main      | default          | :white_check_mark:      | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :white_check_mark:         |
+| envoyproxy     | envoy-gateway        | v1.5.0    | GatewayNamespace | :white_check_mark:      | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :x:                        |
+| envoyproxy     | envoy-gateway        | v1.5.0    | default          | :white_check_mark:      | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :x:                        |
+| istio          | istio                | 1.26.1    | default          | :white_check_mark:      | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :white_check_mark:         |
+| nginx          | nginx-gateway-fabric | v2.0.0    | default          | :white_check_mark:      | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :x:                        |
+| nginx          | nginx-gateway-fabric | v2.1.0    | default          | :white_check_mark:      | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :x:                        |
 
 ## Mesh Profile
 
 ### HTTPRoute
 
-| Organization   | Project   | Version   | Mode    | HTTPRoute Backend Protocol H2C   | HTTPRoute Backend Protocol Web Socket   | HTTPRoute Backend Request Header Modification   | HTTPRoute Backend Timeout   | HTTPRoute Destination Port Matching   | HTTPRoute Host Rewrite   | HTTPRoute Method Matching   | HTTPRoute Path Redirect   | HTTPRoute Path Rewrite   | HTTPRoute Port Redirect   | HTTPRoute Query Param Matching   | HTTPRoute Request Mirror   | HTTPRoute Request Multiple Mirrors   | HTTPRoute Request Percentage Mirror   | HTTPRoute Request Timeout   | HTTPRoute Response Header Modification   | HTTPRoute Scheme Redirect   | Mesh Cluster IP Matching   | HTTPRoute Parent Ref Port   | Mesh Consumer Route   |
-|:---------------|:----------|:----------|:--------|:---------------------------------|:----------------------------------------|:------------------------------------------------|:----------------------------|:--------------------------------------|:-------------------------|:----------------------------|:--------------------------|:-------------------------|:--------------------------|:---------------------------------|:---------------------------|:-------------------------------------|:--------------------------------------|:----------------------------|:-----------------------------------------|:----------------------------|:---------------------------|:----------------------------|:----------------------|
-| cilium         | cilium    | main      | default | :white_check_mark:               | :white_check_mark:                      | :white_check_mark:                              | :white_check_mark:          | :white_check_mark:                    | :white_check_mark:       | :white_check_mark:          | :white_check_mark:        | :white_check_mark:       | :white_check_mark:        | :white_check_mark:               | :white_check_mark:         | :white_check_mark:                   | :white_check_mark:                    | :white_check_mark:          | :white_check_mark:                       | :white_check_mark:          | :white_check_mark:         | :x:                         | :x:                   |
-| istio          | istio     | 1.26.1    | default | :white_check_mark:               | :white_check_mark:                      | :white_check_mark:                              | :white_check_mark:          | :white_check_mark:                    | :white_check_mark:       | :white_check_mark:          | :white_check_mark:        | :white_check_mark:       | :white_check_mark:        | :white_check_mark:               | :white_check_mark:         | :white_check_mark:                   | :white_check_mark:                    | :white_check_mark:          | :white_check_mark:                       | :white_check_mark:          | :x:                        | :white_check_mark:          | :white_check_mark:    |
\ No newline at end of file
+| Organization   | Project                        | Version         | Mode    | HTTPRoute Backend Protocol H2C   | HTTPRoute Backend Protocol Web Socket   | HTTPRoute Backend Request Header Modification   | HTTPRoute Backend Timeout   | HTTPRoute Destination Port Matching   | HTTPRoute Host Rewrite   | HTTPRoute Method Matching   | HTTPRoute Parent Ref Port   | HTTPRoute Path Redirect   | HTTPRoute Path Rewrite   | HTTPRoute Port Redirect   | HTTPRoute Query Param Matching   | HTTPRoute Request Mirror   | HTTPRoute Request Multiple Mirrors   | HTTPRoute Request Percentage Mirror   | HTTPRoute Request Timeout   | HTTPRoute Response Header Modification   | HTTPRoute Scheme Redirect   | Mesh Cluster IP Matching   | Mesh Consumer Route   | Mesh HTTPRoute Backend Request Header Modification   | Mesh HTTPRoute Query Param Matching   | Mesh HTTPRoute Redirect Port   | Mesh HTTPRoute Scheme Redirect   |
+|:---------------|:-------------------------------|:----------------|:--------|:---------------------------------|:----------------------------------------|:------------------------------------------------|:----------------------------|:--------------------------------------|:-------------------------|:----------------------------|:----------------------------|:--------------------------|:-------------------------|:--------------------------|:---------------------------------|:---------------------------|:-------------------------------------|:--------------------------------------|:----------------------------|:-----------------------------------------|:----------------------------|:---------------------------|:----------------------|:-----------------------------------------------------|:--------------------------------------|:-------------------------------|:---------------------------------|
+| Buoyant        | Buoyant Enterprise for Linkerd | enterprise-2.18 | default | :white_check_mark:               | :white_check_mark:                      | :white_check_mark:                              | :white_check_mark:          | :white_check_mark:                    | :white_check_mark:       | :white_check_mark:          | :white_check_mark:          | :white_check_mark:        | :white_check_mark:       | :white_check_mark:        | :white_check_mark:               | :white_check_mark:         | :white_check_mark:                   | :white_check_mark:                    | :white_check_mark:          | :white_check_mark:                       | :white_check_mark:          | :white_check_mark:         | :white_check_mark:    | :white_check_mark:                                   | :white_check_mark:                    | :white_check_mark:             | :white_check_mark:               |
+| Linkerd        | Linkerd                        | version-2.18    | default | :white_check_mark:               | :white_check_mark:                      | :white_check_mark:                              | :white_check_mark:          | :white_check_mark:                    | :white_check_mark:       | :white_check_mark:          | :white_check_mark:          | :white_check_mark:        | :white_check_mark:       | :white_check_mark:        | :white_check_mark:               | :white_check_mark:         | :white_check_mark:                   | :white_check_mark:                    | :white_check_mark:          | :white_check_mark:                       | :white_check_mark:          | :white_check_mark:         | :white_check_mark:    | :white_check_mark:                                   | :white_check_mark:                    | :white_check_mark:             | :white_check_mark:               |
+| cilium         | cilium                         | main            | default | :white_check_mark:               | :white_check_mark:                      | :white_check_mark:                              | :white_check_mark:          | :white_check_mark:                    | :white_check_mark:       | :white_check_mark:          | :x:                         | :white_check_mark:        | :white_check_mark:       | :white_check_mark:        | :white_check_mark:               | :white_check_mark:         | :white_check_mark:                   | :white_check_mark:                    | :white_check_mark:          | :white_check_mark:                       | :white_check_mark:          | :white_check_mark:         | :x:                   | :x:                                                  | :x:                                   | :x:                            | :x:                              |
+| istio          | istio                          | 1.26.1          | default | :white_check_mark:               | :white_check_mark:                      | :white_check_mark:                              | :white_check_mark:          | :white_check_mark:                    | :white_check_mark:       | :white_check_mark:          | :white_check_mark:          | :white_check_mark:        | :white_check_mark:       | :white_check_mark:        | :white_check_mark:               | :white_check_mark:         | :white_check_mark:                   | :white_check_mark:                    | :white_check_mark:          | :white_check_mark:                       | :white_check_mark:          | :x:                        | :white_check_mark:    | :x:                                                  | :x:                                   | :x:                            | :x:                              |
\ No newline at end of file


Test patch:
diff --git a/conformance/tests/backendtlspolicy-san.go b/conformance/tests/backendtlspolicy-san.go
new file mode 100644
index 00000000..38e7a2b4
--- /dev/null
+++ b/conformance/tests/backendtlspolicy-san.go
@@ -0,0 +1,163 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package tests
+
+import (
+	"testing"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
+
+	gatewayv1 "sigs.k8s.io/gateway-api/apis/v1"
+	"sigs.k8s.io/gateway-api/apis/v1alpha2"
+	h "sigs.k8s.io/gateway-api/conformance/utils/http"
+	"sigs.k8s.io/gateway-api/conformance/utils/kubernetes"
+	"sigs.k8s.io/gateway-api/conformance/utils/suite"
+	"sigs.k8s.io/gateway-api/pkg/features"
+)
+
+func init() {
+	ConformanceTests = append(ConformanceTests, BackendTLSPolicySANValidation)
+}
+
+var BackendTLSPolicySANValidation = suite.ConformanceTest{
+	ShortName:   "BackendTLSPolicySANValidation",
+	Description: "BackendTLSPolicySANValidation extend BackendTLSPolicy with SubjectAltNames validation",
+	Features: []features.FeatureName{
+		features.SupportGateway,
+		features.SupportHTTPRoute,
+		features.SupportBackendTLSPolicy,
+		features.SupportBackendTLSPolicySANValidation,
+	},
+	Manifests: []string{"tests/backendtlspolicy-san.yaml"},
+	Test: func(t *testing.T, suite *suite.ConformanceTestSuite) {
+		ns := "gateway-conformance-infra"
+		routeNN := types.NamespacedName{Name: "route-backendtlspolicy-san-test", Namespace: ns}
+		gwNN := types.NamespacedName{Name: "gateway-backendtlspolicy", Namespace: ns}
+
+		kubernetes.NamespacesMustBeReady(t, suite.Client, suite.TimeoutConfig, []string{ns})
+		gwAddr := kubernetes.GatewayAndRoutesMustBeAccepted(t, suite.Client, suite.TimeoutConfig, suite.ControllerName, kubernetes.NewGatewayRef(gwNN), &gatewayv1.HTTPRoute{}, false, routeNN)
+		kubernetes.HTTPRouteMustHaveResolvedRefsConditionsTrue(t, suite.Client, suite.TimeoutConfig, routeNN, gwNN)
+
+		policyCond := metav1.Condition{
+			Type:   string(v1alpha2.PolicyConditionAccepted),
+			Status: metav1.ConditionTrue,
+			Reason: string(v1alpha2.PolicyReasonAccepted),
+		}
+
+		serverStr := "abc.example.com"
+
+		// Verify that the request sent to Service with valid BackendTLSPolicy containing dns SAN should succeed.
+		t.Run("HTTP request sent to Service with valid BackendTLSPolicy containing dns SAN should succeed", func(t *testing.T) {
+			policyNN := types.NamespacedName{Name: "backendtlspolicy-san-dns", Namespace: ns}
+			kubernetes.BackendTLSPolicyMustHaveCondition(t, suite.Client, suite.TimeoutConfig, policyNN, gwNN, policyCond)
+
+			h.MakeRequestAndExpectEventuallyConsistentResponse(t, suite.RoundTripper, suite.TimeoutConfig, gwAddr,
+				h.ExpectedResponse{
+					Namespace: ns,
+					Request: h.Request{
+						Host: serverStr,
+						Path: "/backendTLSSanDns",
+						SNI:  serverStr,
+					},
+					Response: h.Response{StatusCode: 200},
+				})
+		})
+
+		// Verify that the request sent to a Service targeted by a BackendTLSPolicy with mismatched dns SAN should fail.
+		t.Run("HTTP request sent to Service targeted by BackendTLSPolicy with mismatched dns SAN should return an HTTP error", func(t *testing.T) {
+			policyNN := types.NamespacedName{Name: "backendtlspolicy-san-dns-mismatch", Namespace: ns}
+			kubernetes.BackendTLSPolicyMustHaveCondition(t, suite.Client, suite.TimeoutConfig, policyNN, gwNN, policyCond)
+
+			h.MakeRequestAndExpectFailure(t, suite.RoundTripper, suite.TimeoutConfig, gwAddr,
+				h.ExpectedResponse{
+					Namespace: ns,
+					Request: h.Request{
+						Host: serverStr,
+						Path: "/backendTLSSanDnsMismatch",
+						SNI:  serverStr,
+					},
+				})
+		})
+
+		// Verify that the request sent to Service with valid BackendTLSPolicy containing uri SAN should succeed.
+		t.Run("HTTP request sent to Service with valid BackendTLSPolicy containing uri SAN should succeed", func(t *testing.T) {
+			policyNN := types.NamespacedName{Name: "backendtlspolicy-san-uri", Namespace: ns}
+			kubernetes.BackendTLSPolicyMustHaveCondition(t, suite.Client, suite.TimeoutConfig, policyNN, gwNN, policyCond)
+
+			h.MakeRequestAndExpectEventuallyConsistentResponse(t, suite.RoundTripper, suite.TimeoutConfig, gwAddr,
+				h.ExpectedResponse{
+					Namespace: ns,
+					Request: h.Request{
+						Host: serverStr,
+						Path: "/backendTLSSanUri",
+						SNI:  serverStr,
+					},
+					Response: h.Response{StatusCode: 200},
+				})
+		})
+
+		// Verify that the request sent to a Service targeted by a BackendTLSPolicy with mismatched uri SAN should fail.
+		t.Run("HTTP request sent to Service targeted by BackendTLSPolicy with mismatched uri SAN should return an HTTP error", func(t *testing.T) {
+			policyNN := types.NamespacedName{Name: "backendtlspolicy-san-uri-mismatch", Namespace: ns}
+			kubernetes.BackendTLSPolicyMustHaveCondition(t, suite.Client, suite.TimeoutConfig, policyNN, gwNN, policyCond)
+
+			h.MakeRequestAndExpectFailure(t, suite.RoundTripper, suite.TimeoutConfig, gwAddr,
+				h.ExpectedResponse{
+					Namespace: ns,
+					Request: h.Request{
+						Host: serverStr,
+						Path: "/backendTLSSanUriMismatch",
+						SNI:  serverStr,
+					},
+				})
+		})
+
+		// Verify that the request sent to Service with valid BackendTLSPolicy containing multi SANs should succeed.
+		t.Run("HTTP request sent to Service with valid BackendTLSPolicy containing multi SAN should succeed", func(t *testing.T) {
+			policyNN := types.NamespacedName{Name: "backendtlspolicy-multiple-sans", Namespace: ns}
+			kubernetes.BackendTLSPolicyMustHaveCondition(t, suite.Client, suite.TimeoutConfig, policyNN, gwNN, policyCond)
+
+			h.MakeRequestAndExpectEventuallyConsistentResponse(t, suite.RoundTripper, suite.TimeoutConfig, gwAddr,
+				h.ExpectedResponse{
+					Namespace: ns,
+					Request: h.Request{
+						Host: serverStr,
+						Path: "/backendTLSMultiSans",
+						SNI:  serverStr,
+					},
+					Response: h.Response{StatusCode: 200},
+				})
+		})
+
+		// Verify that the request sent to a Service targeted by a BackendTLSPolicy with mismatched multi SAN should fail.
+		t.Run("HTTP request sent to Service targeted by BackendTLSPolicy with mismatched multi SAN should return an HTTP error", func(t *testing.T) {
+			policyNN := types.NamespacedName{Name: "backendtlspolicy-multiple-mismatch-sans", Namespace: ns}
+			kubernetes.BackendTLSPolicyMustHaveCondition(t, suite.Client, suite.TimeoutConfig, policyNN, gwNN, policyCond)
+
+			h.MakeRequestAndExpectFailure(t, suite.RoundTripper, suite.TimeoutConfig, gwAddr,
+				h.ExpectedResponse{
+					Namespace: ns,
+					Request: h.Request{
+						Host: serverStr,
+						Path: "/backendTLSMultiMismatchSans",
+						SNI:  serverStr,
+					},
+				})
+		})
+	},
+}
diff --git a/conformance/tests/backendtlspolicy-san.yaml b/conformance/tests/backendtlspolicy-san.yaml
new file mode 100644
index 00000000..e3e0f79b
--- /dev/null
+++ b/conformance/tests/backendtlspolicy-san.yaml
@@ -0,0 +1,341 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: route-backendtlspolicy-san-test
+  namespace: gateway-conformance-infra
+spec:
+  parentRefs:
+  - name: gateway-backendtlspolicy
+    namespace: gateway-conformance-infra
+  hostnames:
+  - abc.example.com
+  rules:
+  - backendRefs:
+    - group: ""
+      kind: Service
+      name: backendtlspolicy-san-dns-test
+      port: 443
+    matches:
+    - path:
+        type: Exact
+        value: /backendTLSSanDns
+  - backendRefs:
+    - group: ""
+      kind: Service
+      name: backendtlspolicy-san-dns-mismatch-test
+      port: 443
+    matches:
+    - path:
+        type: Exact
+        value: /backendTLSSanDnsMismatch
+  - backendRefs:
+    - group: ""
+      kind: Service
+      name: backendtlspolicy-san-uri-test
+      port: 443
+    matches:
+    - path:
+        type: Exact
+        value: /backendTLSSanUri
+  - backendRefs:
+    - group: ""
+      kind: Service
+      name: backendtlspolicy-san-uri-mismatch-test
+      port: 443
+    matches:
+    - path:
+        type: Exact
+        value: /backendTLSSanUriMismatch
+  - backendRefs:
+    - group: ""
+      kind: Service
+      name: backendtlspolicy-multiple-sans-test
+      port: 443
+    matches:
+    - path:
+        type: Exact
+        value: /backendTLSMultiSans
+  - backendRefs:
+    - group: ""
+      kind: Service
+      name: backendtlspolicy-multiple-mismatch-sans-test
+      port: 443
+    matches:
+    - path:
+        type: Exact
+        value: /backendTLSMultiMismatchSans
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: backendtlspolicy-san-dns-test
+  namespace: gateway-conformance-infra
+spec:
+  selector:
+    app: backendtlspolicy-san-test
+  ports:
+  - name: "btls"
+    protocol: TCP
+    port: 443
+    targetPort: 8443
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: backendtlspolicy-san-dns-mismatch-test
+  namespace: gateway-conformance-infra
+spec:
+  selector:
+    app: backendtlspolicy-san-test
+  ports:
+  - name: "btls"
+    protocol: TCP
+    appProtocol: HTTPS
+    port: 443
+    targetPort: 8443
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: backendtlspolicy-san-uri-test
+  namespace: gateway-conformance-infra
+spec:
+  selector:
+    app: backendtlspolicy-san-test
+  ports:
+  - name: "btls"
+    protocol: TCP
+    appProtocol: HTTPS
+    port: 443
+    targetPort: 8443
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: backendtlspolicy-san-uri-mismatch-test
+  namespace: gateway-conformance-infra
+spec:
+  selector:
+    app: backendtlspolicy-san-test
+  ports:
+  - name: "btls"
+    protocol: TCP
+    appProtocol: HTTPS
+    port: 443
+    targetPort: 8443
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: backendtlspolicy-multiple-sans-test
+  namespace: gateway-conformance-infra
+spec:
+  selector:
+    app: backendtlspolicy-san-test
+  ports:
+  - name: "btls"
+    protocol: TCP
+    appProtocol: HTTPS
+    port: 443
+    targetPort: 8443
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: backendtlspolicy-multiple-mismatch-sans-test
+  namespace: gateway-conformance-infra
+spec:
+  selector:
+    app: backendtlspolicy-san-test
+  ports:
+  - name: "btls"
+    protocol: TCP
+    appProtocol: HTTPS
+    port: 443
+    targetPort: 8443
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: backendtlspolicy-san-test
+  namespace: gateway-conformance-infra
+  labels:
+    app: backendtlspolicy-san-test
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: backendtlspolicy-san-test
+  template:
+    metadata:
+      labels:
+        app: backendtlspolicy-san-test
+    spec:
+      containers:
+      - name: backendtlspolicy-san-test
+        image: gcr.io/k8s-staging-gateway-api/echo-basic:v20240412-v1.0.0-394-g40c666fd
+        volumeMounts:
+        - name: secret-volume
+          mountPath: /etc/secret-volume
+        env:
+        - name: POD_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.name
+        - name: NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
+        - name: TLS_SERVER_CERT
+          value: /etc/secret-volume/crt
+        - name: TLS_SERVER_PRIVKEY
+          value: /etc/secret-volume/key
+        resources:
+          requests:
+            cpu: 10m
+      volumes:
+      - name: secret-volume
+        secret:
+          # This secret is generated dynamically by the test suite.
+          secretName: tls-with-san-certificate
+          items:
+          - key: tls.crt
+            path: crt
+          - key: tls.key
+            path: key
+---
+apiVersion: gateway.networking.k8s.io/v1alpha3
+kind: BackendTLSPolicy
+metadata:
+  name: backendtlspolicy-san-dns
+  namespace: gateway-conformance-infra
+spec:
+  targetRefs:
+  - group: ""
+    kind: Service
+    name: backendtlspolicy-san-dns-test
+    sectionName: "btls"
+  validation:
+    caCertificateRefs:
+    - group: ""
+      kind: ConfigMap
+      # This secret is generated dynamically by the test suite.
+      name: "backend-tls-with-san-certificate"
+    hostname: "abc.example.com"
+    subjectAltNames:
+    - type: "Hostname"
+      hostname: "abc.example.com"
+---
+apiVersion: gateway.networking.k8s.io/v1alpha3
+kind: BackendTLSPolicy
+metadata:
+  name: backendtlspolicy-san-dns-mismatch
+  namespace: gateway-conformance-infra
+spec:
+  targetRefs:
+  - group: ""
+    kind: Service
+    name: backendtlspolicy-san-dns-mismatch-test
+    sectionName: "btls"
+  validation:
+    caCertificateRefs:
+    - group: ""
+      kind: ConfigMap
+      # This secret is generated dynamically by the test suite.
+      name: "backend-tls-with-san-certificate"
+    hostname: "abc.example.com"
+    subjectAltNames:
+    - type: "Hostname"
+      hostname: "dce.example.com"
+---
+apiVersion: gateway.networking.k8s.io/v1alpha3
+kind: BackendTLSPolicy
+metadata:
+  name: backendtlspolicy-san-uri
+  namespace: gateway-conformance-infra
+spec:
+  targetRefs:
+  - group: ""
+    kind: Service
+    name: backendtlspolicy-san-uri-test
+    sectionName: "btls"
+  validation:
+    caCertificateRefs:
+    - group: ""
+      kind: ConfigMap
+      # This secret is generated dynamically by the test suite.
+      name: "backend-tls-with-san-certificate"
+    hostname: "abc.example.com"
+    subjectAltNames:
+    - type: "URI"
+      uri: "spiffe://abc.example.com/test-identity"
+---
+apiVersion: gateway.networking.k8s.io/v1alpha3
+kind: BackendTLSPolicy
+metadata:
+  name: backendtlspolicy-san-uri-mismatch
+  namespace: gateway-conformance-infra
+spec:
+  targetRefs:
+  - group: ""
+    kind: Service
+    name: backendtlspolicy-san-uri-mismatch-test
+    sectionName: "btls"
+  validation:
+    caCertificateRefs:
+    - group: ""
+      kind: ConfigMap
+      # This secret is generated dynamically by the test suite.
+      name: "backend-tls-with-san-certificate"
+    hostname: "abc.example.com"
+    subjectAltNames:
+    - type: "URI"
+      uri: "spiffe://def.example.com/test-identity"
+---
+apiVersion: gateway.networking.k8s.io/v1alpha3
+kind: BackendTLSPolicy
+metadata:
+  name: backendtlspolicy-multiple-sans
+  namespace: gateway-conformance-infra
+spec:
+  targetRefs:
+  - group: ""
+    kind: Service
+    name: backendtlspolicy-multiple-sans-test
+    sectionName: "btls"
+  validation:
+    caCertificateRefs:
+    - group: ""
+      kind: ConfigMap
+      # This secret is generated dynamically by the test suite.
+      name: "backend-tls-with-san-certificate"
+    hostname: "abc.example.com"
+    subjectAltNames:
+    - type: "URI"
+      uri: "spiffe://abc.example.com/test-identity"
+    - type: "Hostname"
+      hostname: "abc.example.com"
+---
+apiVersion: gateway.networking.k8s.io/v1alpha3
+kind: BackendTLSPolicy
+metadata:
+  name: backendtlspolicy-multiple-mismatch-sans
+  namespace: gateway-conformance-infra
+spec:
+  targetRefs:
+  - group: ""
+    kind: Service
+    name: backendtlspolicy-multiple-mismatch-sans-test
+    sectionName: "btls"
+  validation:
+    caCertificateRefs:
+    - group: ""
+      kind: ConfigMap
+      # This secret is generated dynamically by the test suite.
+      name: "backend-tls-with-san-certificate"
+    hostname: "abc.example.com"
+    subjectAltNames:
+    - type: "URI"
+      uri: "spiffe://def.example.com/test-identity"
+    - type: "Hostname"
+      hostname: "def.example.com"
diff --git a/conformance/tests/backendtlspolicy.yaml b/conformance/tests/backendtlspolicy.yaml
index e048cc2e..6d0cab8e 100644
--- a/conformance/tests/backendtlspolicy.yaml
+++ b/conformance/tests/backendtlspolicy.yaml
@@ -1,37 +1,4 @@
 apiVersion: gateway.networking.k8s.io/v1
-kind: Gateway
-metadata:
-  name: gateway-backendtlspolicy
-  namespace: gateway-conformance-infra
-spec:
-  gatewayClassName: "{GATEWAY_CLASS_NAME}"
-  listeners:
-  - name: http
-    port: 80
-    protocol: HTTP
-    hostname: "abc.example.com"
-    allowedRoutes:
-      namespaces:
-        from: Same
-      kinds:
-      - kind: HTTPRoute
-  - name: https
-    port: 443
-    protocol: HTTPS
-    tls:
-      mode: Terminate
-      certificateRefs:
-      - group: ""
-        kind: Secret
-        name: tls-checks-certificate
-    hostname: "abc.example.com"
-    allowedRoutes:
-      namespaces:
-        from: Same
-      kinds:
-      - kind: HTTPRoute
----
-apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
   name: gateway-conformance-infra-test
diff --git a/conformance/tests/httproute-weight.go b/conformance/tests/httproute-weight.go
index fa85deb9..bafd768a 100644
--- a/conformance/tests/httproute-weight.go
+++ b/conformance/tests/httproute-weight.go
@@ -59,8 +59,10 @@ var HTTPRouteWeight = suite.ConformanceTest{
 
 		t.Run("Requests should have a distribution that matches the weight", func(t *testing.T) {
 			expected := http.ExpectedResponse{
-				Request:   http.Request{Path: "/"},
-				Response:  http.Response{StatusCode: 200},
+				Request: http.Request{Path: "/"},
+				Response: http.Response{
+					StatusCodes: []int{200},
+				},
 				Namespace: "gateway-conformance-infra",
 			}