Repository: envoyproxy/gateway

Issue:
Mixed FQDN and IP/UDS endpoints when using multiple backendRefs
*Description*:
Create `SecurityPolicy` or `EnvoyExtensionPolicy` with two `backendRefs` for ext-auth/proc:
-  An FQDN `Backend` 
- A K8s `Service` or `Backend` with UDS/IP endpoints

The policies are accepted, but envoy rejects the config: 
``
[2025-01-14 00:12:26.958][1][warning][config] [source/extensions/config_subscription/grpc/grpc_subscription_impl.cc:138] gRPC config for type.googleapis.com/envoy.config.endpoint.v3.ClusterLoadAssignment rejected: malformed IP address: foo.br. Consider setting resolver_name or setting cluster type to 'STRICT_DNS' or 'LOGICAL_DNS'
``

Similar to mixed-endpoint checks within a single destination, EG should verify that endpoints aggregated from multiple destinations are not mixed. 

*Repro steps*:
> Include sample requests, environment, etc. All data and inputs
required to reproduce the bug.

>**Note**: If there are privacy concerns, sanitize the data prior to
sharing.

*Environment*:
>Include the environment like gateway version, envoy version and so on.

*Logs*:
>Include the access logs and the Envoy logs.


Discussion:

Solution patch:
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 653cc9bbf..6559da345 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -33,6 +33,8 @@ updates:
     ignore:
       # Ignore cel-go, since it should be updated alongside k8s.io/apiserver
       - dependency-name: "github.com/google/cel-go"
+      # Ignore github.com/docker/docker, since it should be updated alongside github.com/google/go-containerregistry
+      - dependency-name: github.com/docker/docker
     groups:
       github.com:
         patterns:
@@ -44,8 +46,7 @@ updates:
       go.opentelemetry.io:
         patterns:
           - "go.opentelemetry.io*"
-      golang.org:
-        patterns:
+          # Merge golang/google groups into group, since it should be updated alongside opentelemetry
           - "golang*"
           - "google*"
   - package-ecosystem: pip
diff --git a/.github/workflows/build_and_test.yaml b/.github/workflows/build_and_test.yaml
index 3e55db347..3a50839b3 100644
--- a/.github/workflows/build_and_test.yaml
+++ b/.github/workflows/build_and_test.yaml
@@ -211,7 +211,7 @@ jobs:
     # build and push image
     - name: Login to DockerHub
       if: github.event_name == 'push'
-      uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567  # v3.3.0
+      uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772  # v3.4.0
       with:
         username: ${{ vars.DOCKERHUB_USERNAME }}
         password: ${{ secrets.DOCKERHUB_PASSWORD }}
diff --git a/.github/workflows/docs.yaml b/.github/workflows/docs.yaml
index 89c70deb0..ed7dced91 100644
--- a/.github/workflows/docs.yaml
+++ b/.github/workflows/docs.yaml
@@ -60,7 +60,7 @@ jobs:
         extended: true
 
     - name: Setup Node
-      uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a  # v4.2.0
+      uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e  # v4.3.0
       with:
         node-version: '18'
 
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 6ee9a5c9b..992d2d86e 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -61,7 +61,7 @@ jobs:
           echo "sha_short=$(git rev-parse --short HEAD)" >> $GITHUB_ENV
 
       - name: Login to DockerHub
-        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567  # v3.3.0
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772  # v3.4.0
         with:
           username: ${{ vars.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_PASSWORD }}
diff --git a/.github/workflows/trivy.yml b/.github/workflows/trivy.yml
index 3f222283a..28a1cf618 100644
--- a/.github/workflows/trivy.yml
+++ b/.github/workflows/trivy.yml
@@ -25,7 +25,7 @@ jobs:
         IMAGE=envoy-proxy/gateway-dev TAG=${{ github.sha }} make image
 
     - name: Run Trivy vulnerability scanner
-      uses: aquasecurity/trivy-action@18f2510ee396bbf400402947b394f2dd8c87dbb0  # v0.29.0
+      uses: aquasecurity/trivy-action@6c175e9c4083a92bbca2f9724c8a5e33bc2d97a5  # v0.30.0
       with:
         image-ref: envoy-proxy/gateway-dev:${{ github.sha }}
         exit-code: '1'
diff --git a/examples/envoy-ext-auth/Dockerfile b/examples/envoy-ext-auth/Dockerfile
index fe4f06f79..1bbf19177 100644
--- a/examples/envoy-ext-auth/Dockerfile
+++ b/examples/envoy-ext-auth/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.24.0 AS builder
+FROM golang:1.24.1 AS builder
 
 ARG GO_LDFLAGS=""
 
diff --git a/examples/envoy-ext-auth/go.mod b/examples/envoy-ext-auth/go.mod
index 5458c76cd..3bdd5d268 100644
--- a/examples/envoy-ext-auth/go.mod
+++ b/examples/envoy-ext-auth/go.mod
@@ -1,6 +1,6 @@
 module github.com/envoyproxy/gateway-grcp-ext-auth
 
-go 1.24.0
+go 1.24.1
 
 require (
 	github.com/envoyproxy/go-control-plane/envoy v1.32.4
diff --git a/examples/extension-server/go.mod b/examples/extension-server/go.mod
index bce1f25d1..97e9cf38f 100644
--- a/examples/extension-server/go.mod
+++ b/examples/extension-server/go.mod
@@ -1,9 +1,9 @@
 module github.com/exampleorg/envoygateway-extension
 
-go 1.24.0
+go 1.24.1
 
 require (
-	github.com/envoyproxy/gateway v1.3.0
+	github.com/envoyproxy/gateway v1.3.1
 	github.com/envoyproxy/go-control-plane v0.13.5-0.20250303232259-0c5cb90447bb
 	github.com/envoyproxy/go-control-plane/envoy v1.32.5-0.20250303232259-0c5cb90447bb
 	github.com/urfave/cli/v2 v2.27.6
@@ -43,8 +43,8 @@ require (
 	golang.org/x/sys v0.31.0 // indirect
 	golang.org/x/text v0.23.0 // indirect
 	golang.org/x/tools v0.30.0 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20250115164207-1a7da9e5054f // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20250212204824-5a70512c5d8b // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20250218202821-56aae31c358a // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20250218202821-56aae31c358a // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
diff --git a/examples/extension-server/go.sum b/examples/extension-server/go.sum
index 60d0450b0..ce4e52cb8 100644
--- a/examples/extension-server/go.sum
+++ b/examples/extension-server/go.sum
@@ -101,16 +101,16 @@ github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9de
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA=
 go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A=
-go.opentelemetry.io/otel v1.34.0 h1:zRLXxLCgL1WyKsPVrgbSdMN4c0FMkDAskSTQP+0hdUY=
-go.opentelemetry.io/otel v1.34.0/go.mod h1:OWFPOQ+h4G8xpyjgqo4SxJYdDQ/qmRH+wivy7zzx9oI=
-go.opentelemetry.io/otel/metric v1.34.0 h1:+eTR3U0MyfWjRDhmFMxe2SsW64QrZ84AOhvqS7Y+PoQ=
-go.opentelemetry.io/otel/metric v1.34.0/go.mod h1:CEDrp0fy2D0MvkXE+dPV7cMi8tWZwX3dmaIhwPOaqHE=
-go.opentelemetry.io/otel/sdk v1.34.0 h1:95zS4k/2GOy069d321O8jWgYsW3MzVV+KuSPKp7Wr1A=
-go.opentelemetry.io/otel/sdk v1.34.0/go.mod h1:0e/pNiaMAqaykJGKbi+tSjWfNNHMTxoC9qANsCzbyxU=
-go.opentelemetry.io/otel/sdk/metric v1.34.0 h1:5CeK9ujjbFVL5c1PhLuStg1wxA7vQv7ce1EK0Gyvahk=
-go.opentelemetry.io/otel/sdk/metric v1.34.0/go.mod h1:jQ/r8Ze28zRKoNRdkjCZxfs6YvBTG1+YIqyFVFYec5w=
-go.opentelemetry.io/otel/trace v1.34.0 h1:+ouXS2V8Rd4hp4580a8q23bg0azF2nI8cqLYnC8mh/k=
-go.opentelemetry.io/otel/trace v1.34.0/go.mod h1:Svm7lSjQD7kG7KJ/MUHPVXSDGz2OX4h0M2jHBhmSfRE=
+go.opentelemetry.io/otel v1.35.0 h1:xKWKPxrxB6OtMCbmMY021CqC45J+3Onta9MqjhnusiQ=
+go.opentelemetry.io/otel v1.35.0/go.mod h1:UEqy8Zp11hpkUrL73gSlELM0DupHoiq72dR+Zqel/+Y=
+go.opentelemetry.io/otel/metric v1.35.0 h1:0znxYu2SNyuMSQT4Y9WDWej0VpcsxkuklLa4/siN90M=
+go.opentelemetry.io/otel/metric v1.35.0/go.mod h1:nKVFgxBZ2fReX6IlyW28MgZojkoAkJGaE8CpgeAU3oE=
+go.opentelemetry.io/otel/sdk v1.35.0 h1:iPctf8iprVySXSKJffSS79eOjl9pvxV9ZqOWT0QejKY=
+go.opentelemetry.io/otel/sdk v1.35.0/go.mod h1:+ga1bZliga3DxJ3CQGg3updiaAJoNECOgJREo9KHGQg=
+go.opentelemetry.io/otel/sdk/metric v1.35.0 h1:1RriWBmCKgkeHEhM7a2uMjMUfP7MsOF5JpUCaEqEI9o=
+go.opentelemetry.io/otel/sdk/metric v1.35.0/go.mod h1:is6XYCUMpcKi+ZsOvfluY5YstFnhW0BidkR+gL+qN+w=
+go.opentelemetry.io/otel/trace v1.35.0 h1:dPpEfJu1sDIqruz7BHFG3c7528f6ddfSWfFDVt/xgMs=
+go.opentelemetry.io/otel/trace v1.35.0/go.mod h1:WUk7DtFp1Aw2MkvqGdwiXYDZZNvA/1J8o6xRXLrIkyc=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
@@ -149,10 +149,10 @@ golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8T
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-google.golang.org/genproto/googleapis/api v0.0.0-20250115164207-1a7da9e5054f h1:gap6+3Gk41EItBuyi4XX/bp4oqJ3UwuIMl25yGinuAA=
-google.golang.org/genproto/googleapis/api v0.0.0-20250115164207-1a7da9e5054f/go.mod h1:Ic02D47M+zbarjYYUlK57y316f2MoN0gjAwI3f2S95o=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20250212204824-5a70512c5d8b h1:FQtJ1MxbXoIIrZHZ33M+w5+dAP9o86rgpjoKr/ZmT7k=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20250212204824-5a70512c5d8b/go.mod h1:8BS3B93F/U1juMFq9+EDk+qOT5CO1R9IzXxG3PTqiRk=
+google.golang.org/genproto/googleapis/api v0.0.0-20250218202821-56aae31c358a h1:nwKuGPlUAt+aR+pcrkfFRrTU1BVrSmYyYMxYbUIVHr0=
+google.golang.org/genproto/googleapis/api v0.0.0-20250218202821-56aae31c358a/go.mod h1:3kWAYMk1I75K4vykHtKt2ycnOgpA6974V7bREqbsenU=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250218202821-56aae31c358a h1:51aaUVRocpvUOSQKM6Q7VuoaktNIaMCLuhZB6DKksq4=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250218202821-56aae31c358a/go.mod h1:uRxBH1mhmO8PGhU89cMcHaXKZqO+OfakD8QQO0oYwlQ=
 google.golang.org/grpc v1.71.0 h1:kF77BGdPTQ4/JZWMlb9VpJ5pa25aqvVqogsxNHHdeBg=
 google.golang.org/grpc v1.71.0/go.mod h1:H0GRtasmQOh9LkFoCPDu3ZrwUtD1YGE+b2vYBYd/8Ec=
 google.golang.org/protobuf v1.36.5 h1:tPhr+woSbjfYvY6/GPufUoYizxw1cF/yFoxJ2fmpwlM=
diff --git a/examples/grpc-ext-proc/Dockerfile b/examples/grpc-ext-proc/Dockerfile
index df26269ad..1208d08bf 100644
--- a/examples/grpc-ext-proc/Dockerfile
+++ b/examples/grpc-ext-proc/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.24.0 AS builder
+FROM golang:1.24.1 AS builder
 
 ARG GO_LDFLAGS=""
 
diff --git a/examples/grpc-ext-proc/go.mod b/examples/grpc-ext-proc/go.mod
index 8f3adecc6..f1478dede 100644
--- a/examples/grpc-ext-proc/go.mod
+++ b/examples/grpc-ext-proc/go.mod
@@ -1,6 +1,6 @@
 module github.com/envoyproxy/gateway-grpc-ext-proc
 
-go 1.24.0
+go 1.24.1
 
 require (
 	github.com/envoyproxy/go-control-plane/envoy v1.32.4
diff --git a/examples/preserve-case-backend/Dockerfile b/examples/preserve-case-backend/Dockerfile
index 3f4a5d006..c945ae23d 100644
--- a/examples/preserve-case-backend/Dockerfile
+++ b/examples/preserve-case-backend/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.24.0 AS builder
+FROM golang:1.24.1 AS builder
 
 ARG GO_LDFLAGS=""
 
diff --git a/examples/preserve-case-backend/go.mod b/examples/preserve-case-backend/go.mod
index 32bc13d30..ebd488846 100644
--- a/examples/preserve-case-backend/go.mod
+++ b/examples/preserve-case-backend/go.mod
@@ -1,6 +1,6 @@
 module github.com/envoyproxy/gateway-preserve-case-backend
 
-go 1.24.0
+go 1.24.1
 
 require github.com/valyala/fasthttp v1.59.0
 
diff --git a/examples/static-file-server/Dockerfile b/examples/static-file-server/Dockerfile
index b8b77e32f..bb5667297 100644
--- a/examples/static-file-server/Dockerfile
+++ b/examples/static-file-server/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.24.0 AS builder
+FROM golang:1.24.1 AS builder
 
 ARG GO_LDFLAGS=""
 
diff --git a/examples/static-file-server/go.mod b/examples/static-file-server/go.mod
index 4d6a0a5d2..107c3745f 100644
--- a/examples/static-file-server/go.mod
+++ b/examples/static-file-server/go.mod
@@ -1,3 +1,3 @@
 module github.com/envoyproxy/static-file-server
 
-go 1.24.0
+go 1.24.1
diff --git a/go.mod b/go.mod
index 6ed9fc590..3c2370e2f 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/envoyproxy/gateway
 
-go 1.24.0
+go 1.24.1
 
 require (
 	fortio.org/fortio v1.68.0
@@ -36,12 +36,12 @@ require (
 	github.com/google/go-containerregistry v0.20.3
 	github.com/hashicorp/go-multierror v1.1.1
 	github.com/miekg/dns v1.1.63
-	github.com/ohler55/ojg v1.26.1
+	github.com/ohler55/ojg v1.26.2
 	github.com/pkg/errors v0.9.1
 	github.com/prometheus/client_golang v1.21.1
 	github.com/prometheus/client_model v0.6.1
-	github.com/prometheus/common v0.62.0
-	github.com/replicatedhq/troubleshoot v0.117.0
+	github.com/prometheus/common v0.63.0
+	github.com/replicatedhq/troubleshoot v0.118.0
 	github.com/spf13/cobra v1.9.1
 	github.com/spf13/pflag v1.0.6
 	github.com/stretchr/testify v1.10.0
@@ -49,23 +49,23 @@ require (
 	github.com/tetratelabs/func-e v1.1.5-0.20240822223546-c85a098d5bf0
 	github.com/tsaarni/certyaml v0.10.0
 	github.com/yuin/gopher-lua v1.1.1
-	go.opentelemetry.io/otel v1.34.0
-	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.34.0
-	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.34.0
-	go.opentelemetry.io/otel/exporters/prometheus v0.56.0
-	go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.34.0
-	go.opentelemetry.io/otel/metric v1.34.0
-	go.opentelemetry.io/otel/sdk v1.34.0
-	go.opentelemetry.io/otel/sdk/metric v1.34.0
+	go.opentelemetry.io/otel v1.35.0
+	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.35.0
+	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.35.0
+	go.opentelemetry.io/otel/exporters/prometheus v0.57.0
+	go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.35.0
+	go.opentelemetry.io/otel/metric v1.35.0
+	go.opentelemetry.io/otel/sdk v1.35.0
+	go.opentelemetry.io/otel/sdk/metric v1.35.0
 	go.opentelemetry.io/proto/otlp v1.5.0
 	go.uber.org/zap v1.27.0
 	golang.org/x/exp v0.0.0-20250106191152-7588d65b2ba8
 	golang.org/x/net v0.37.0
-	google.golang.org/genproto/googleapis/api v0.0.0-20250115164207-1a7da9e5054f
+	google.golang.org/genproto/googleapis/api v0.0.0-20250218202821-56aae31c358a
 	google.golang.org/grpc v1.71.0
 	google.golang.org/protobuf v1.36.5
 	gopkg.in/yaml.v3 v3.0.1
-	helm.sh/helm/v3 v3.17.1
+	helm.sh/helm/v3 v3.17.2
 	k8s.io/api v0.32.2
 	k8s.io/apiextensions-apiserver v0.32.2
 	k8s.io/apimachinery v0.33.0-alpha.3
@@ -170,7 +170,7 @@ require (
 	github.com/containerd/stargz-snapshotter/estargz v0.16.3 // indirect
 	github.com/containerd/ttrpc v1.2.7 // indirect
 	github.com/containerd/typeurl/v2 v2.2.3 // indirect
-	github.com/containers/image/v5 v5.34.0 // indirect
+	github.com/containers/image/v5 v5.34.1 // indirect
 	github.com/containers/libtrust v0.0.0-20230121012942-c1716e8a8d01 // indirect
 	github.com/containers/ocicrypt v1.2.1 // indirect
 	github.com/containers/storage v1.57.1 // indirect
@@ -216,7 +216,7 @@ require (
 	github.com/go-openapi/loads v0.22.0 // indirect
 	github.com/go-openapi/swag v0.23.0 // indirect
 	github.com/go-redis/redis/v7 v7.4.1 // indirect
-	github.com/go-sql-driver/mysql v1.8.1 // indirect
+	github.com/go-sql-driver/mysql v1.9.0 // indirect
 	github.com/go-task/slim-sprig/v3 v3.0.0 // indirect
 	github.com/go-toolsmith/astcast v1.1.0 // indirect
 	github.com/go-toolsmith/astcopy v1.1.0 // indirect
@@ -264,7 +264,7 @@ require (
 	github.com/gosuri/uitable v0.0.4 // indirect
 	github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79 // indirect
 	github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0 // indirect
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.25.1 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.1 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-immutable-radix/v2 v2.1.0 // indirect
 	github.com/hashicorp/go-version v1.7.0 // indirect
@@ -355,8 +355,8 @@ require (
 	github.com/olekukonko/tablewriter v0.0.5 // indirect
 	github.com/onsi/ginkgo/v2 v2.22.2 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
-	github.com/opencontainers/image-spec v1.1.0 // indirect
-	github.com/opencontainers/runtime-spec v1.2.0 // indirect
+	github.com/opencontainers/image-spec v1.1.1 // indirect
+	github.com/opencontainers/runtime-spec v1.2.1 // indirect
 	github.com/opencontainers/selinux v1.11.1 // indirect
 	github.com/ostreedev/ostree-go v0.0.0-20210805093236-719684c64e4f // indirect
 	github.com/pelletier/go-toml v1.9.5 // indirect
@@ -395,7 +395,7 @@ require (
 	github.com/segmentio/encoding v0.4.1 // indirect
 	github.com/segmentio/ksuid v1.0.4 // indirect
 	github.com/shirou/gopsutil/v3 v3.24.5 // indirect
-	github.com/shirou/gopsutil/v4 v4.25.1 // indirect
+	github.com/shirou/gopsutil/v4 v4.25.2 // indirect
 	github.com/shoenig/go-m1cpu v0.1.6 // indirect
 	github.com/shopspring/decimal v1.4.0 // indirect
 	github.com/sirupsen/logrus v1.9.3 // indirect
@@ -461,7 +461,7 @@ require (
 	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.58.0 // indirect
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.32.0 // indirect
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.32.0 // indirect
-	go.opentelemetry.io/otel/trace v1.34.0 // indirect
+	go.opentelemetry.io/otel/trace v1.35.0 // indirect
 	go.uber.org/automaxprocs v1.6.0 // indirect
 	go.uber.org/mock v0.5.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
@@ -479,7 +479,7 @@ require (
 	golang.org/x/tools v0.30.0 // indirect
 	golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028 // indirect
 	gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20250212204824-5a70512c5d8b // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20250218202821-56aae31c358a // indirect
 	google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.5.1 // indirect
 	gopkg.in/alecthomas/kingpin.v2 v2.2.6 // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
diff --git a/go.sum b/go.sum
index aa8a09fb7..8706b5cda 100644
--- a/go.sum
+++ b/go.sum
@@ -259,8 +259,8 @@ github.com/containerd/ttrpc v1.2.7 h1:qIrroQvuOL9HQ1X6KHe2ohc7p+HP/0VE6XPU7elJRq
 github.com/containerd/ttrpc v1.2.7/go.mod h1:YCXHsb32f+Sq5/72xHubdiJRQY9inL4a4ZQrAbN1q9o=
 github.com/containerd/typeurl/v2 v2.2.3 h1:yNA/94zxWdvYACdYO8zofhrTVuQY73fFU1y++dYSw40=
 github.com/containerd/typeurl/v2 v2.2.3/go.mod h1:95ljDnPfD3bAbDJRugOiShd/DlAAsxGtUBhJxIn7SCk=
-github.com/containers/image/v5 v5.34.0 h1:HPqQaDUsox/3mC1pbOyLAIQEp0JhQqiUZ+6JiFIZLDI=
-github.com/containers/image/v5 v5.34.0/go.mod h1:/WnvUSEfdqC/ahMRd4YJDBLrpYWkGl018rB77iB3FDo=
+github.com/containers/image/v5 v5.34.1 h1:/m2bkFnuedTyNkzma8s7cFLjeefPIb4trjyafWhIlwM=
+github.com/containers/image/v5 v5.34.1/go.mod h1:/WnvUSEfdqC/ahMRd4YJDBLrpYWkGl018rB77iB3FDo=
 github.com/containers/libtrust v0.0.0-20230121012942-c1716e8a8d01 h1:Qzk5C6cYglewc+UyGf6lc8Mj2UaPTHy/iF2De0/77CA=
 github.com/containers/libtrust v0.0.0-20230121012942-c1716e8a8d01/go.mod h1:9rfv8iPl1ZP7aqh9YA68wnZv2NUDbXdcdPHVz0pFbPY=
 github.com/containers/ocicrypt v1.2.1 h1:0qIOTT9DoYwcKmxSt8QJt+VzMY18onl9jUXsxpVhSmM=
@@ -508,8 +508,9 @@ github.com/go-quicktest/qt v1.101.0 h1:O1K29Txy5P2OK0dGo59b7b0LR6wKfIhttaAhHUyn7
 github.com/go-quicktest/qt v1.101.0/go.mod h1:14Bz/f7NwaXPtdYEgzsx46kqSxVwTbzVZsDC26tQJow=
 github.com/go-redis/redis/v7 v7.4.1 h1:PASvf36gyUpr2zdOUS/9Zqc80GbM+9BDyiJSJDDOrTI=
 github.com/go-redis/redis/v7 v7.4.1/go.mod h1:JDNMw23GTyLNC4GZu9njt15ctBQVn7xjRfnwdHj/Dcg=
-github.com/go-sql-driver/mysql v1.8.1 h1:LedoTUt/eveggdHS9qUFC1EFSa8bU2+1pZjSRpvNJ1Y=
 github.com/go-sql-driver/mysql v1.8.1/go.mod h1:wEBSXgmK//2ZFJyE+qWnIsVGmvmEKlqwuVSjsCm7DZg=
+github.com/go-sql-driver/mysql v1.9.0 h1:Y0zIbQXhQKmQgTp44Y1dp3wTXcn804QoTptLZT1vtvo=
+github.com/go-sql-driver/mysql v1.9.0/go.mod h1:pDetrLJeA3oMujJuvXc8RJoasr589B6A9fwzD3QMrqw=
 github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
 github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI=
 github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8=
@@ -692,8 +693,8 @@ github.com/grpc-ecosystem/grpc-gateway v1.9.0/go.mod h1:vNeuVxBJEsws4ogUvrchl83t
 github.com/grpc-ecosystem/grpc-gateway v1.9.5/go.mod h1:vNeuVxBJEsws4ogUvrchl83t/GYV9WGTSLVdBhOQFDY=
 github.com/grpc-ecosystem/grpc-gateway v1.16.0 h1:gmcG1KaJ57LophUzW0Hy8NmPhnMZb4M0+kPpLofRdBo=
 github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFbcEtjT1g+wF4CSlocrBnw=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.25.1 h1:VNqngBF40hVlDloBruUehVYC3ArSgIyScOAyMRqBxRg=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.25.1/go.mod h1:RBRO7fro65R6tjKzYgLAFo0t1QEXY1Dp+i/bvpRiqiQ=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.1 h1:e9Rjr40Z98/clHv5Yg79Is0NtosR5LXRvdr7o/6NwbA=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.1/go.mod h1:tIxuGz/9mpox++sgp9fJjHO0+q1X9/UOWd798aAm22M=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
 github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
@@ -959,8 +960,8 @@ github.com/nunnatsa/ginkgolinter v0.19.0/go.mod h1:jkQ3naZDmxaZMXPWaS9rblH+i+GWX
 github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI8A=
 github.com/nxadm/tail v1.4.8 h1:nPr65rt6Y5JFSKQO7qToXr7pePgD6Gwiw05lkbyAQTE=
 github.com/nxadm/tail v1.4.8/go.mod h1:+ncqLTQzXmGhMZNUePPaPqPvBxHAIsmXswZKocGu+AU=
-github.com/ohler55/ojg v1.26.1 h1:J5TaLmVEuvnpVH7JMdT1QdbpJU545Yp6cKiCO4aQILc=
-github.com/ohler55/ojg v1.26.1/go.mod h1:gQhDVpQLqrmnd2eqGAvJtn+NfKoYJbe/A4Sj3/Vro4o=
+github.com/ohler55/ojg v1.26.2 h1:e0BHIgsihnU+I47tpgwFDk0xYCVygrTjYHyyNAQ9NXg=
+github.com/ohler55/ojg v1.26.2/go.mod h1:ogZ8vVK07fpsAQ898C5QfXDOk5hxzLbkP/Htr7RYs40=
 github.com/oklog/ulid v1.3.1 h1:EGfNDEx6MqHz8B3uNV6QAib1UR2Lm97sHi3ocA6ESJ4=
 github.com/oklog/ulid v1.3.1/go.mod h1:CirwcVhetQ6Lv90oh/F+FBtV6XMibvdAFo93nm5qn4U=
 github.com/olekukonko/tablewriter v0.0.0-20170122224234-a0225b3f23b5/go.mod h1:vsDQFd/mU46D+Z4whnwzcISnGGzXWMclvtLoiIKAKIo=
@@ -985,10 +986,10 @@ github.com/onsi/gomega v1.36.2 h1:koNYke6TVk6ZmnyHrCXba/T/MoLBXFjeC1PtvYgw0A8=
 github.com/onsi/gomega v1.36.2/go.mod h1:DdwyADRjrc825LhMEkD76cHR5+pUnjhUN8GlHlRPHzY=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
-github.com/opencontainers/image-spec v1.1.0 h1:8SG7/vwALn54lVB/0yZ/MMwhFrPYtpEHQb2IpWsCzug=
-github.com/opencontainers/image-spec v1.1.0/go.mod h1:W4s4sFTMaBeK1BQLXbG4AdM2szdn85PY75RI83NrTrM=
-github.com/opencontainers/runtime-spec v1.2.0 h1:z97+pHb3uELt/yiAWD691HNHQIF07bE7dzrbT927iTk=
-github.com/opencontainers/runtime-spec v1.2.0/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
+github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040=
+github.com/opencontainers/image-spec v1.1.1/go.mod h1:qpqAh3Dmcf36wStyyWU+kCeDgrGnAve2nCC8+7h8Q0M=
+github.com/opencontainers/runtime-spec v1.2.1 h1:S4k4ryNgEpxW1dzyqffOmhI1BHYcjzU8lpJfSlR0xww=
+github.com/opencontainers/runtime-spec v1.2.1/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
 github.com/opencontainers/selinux v1.11.1 h1:nHFvthhM0qY8/m+vfhJylliSshm8G1jJ2jDMcgULaH8=
 github.com/opencontainers/selinux v1.11.1/go.mod h1:E5dMC3VPuVvVHDYmi78qvhJp8+M586T4DlDRYpFkyec=
 github.com/orisano/pixelmatch v0.0.0-20220722002657-fb0b55479cde/go.mod h1:nZgzbfBr3hhjoZnS66nKrHmduYNpc34ny7RK4z5/HM0=
@@ -1050,8 +1051,8 @@ github.com/prometheus/common v0.0.0-20181113130724-41aa239b4cce/go.mod h1:daVV7q
 github.com/prometheus/common v0.4.0/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
 github.com/prometheus/common v0.4.1/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
 github.com/prometheus/common v0.6.0/go.mod h1:eBmuwkDJBwy6iBfxCBob6t6dR6ENT/y+J+Zk0j9GMYc=
-github.com/prometheus/common v0.62.0 h1:xasJaQlnWAeyHdUBeGjXmutelfJHWMRr+Fg4QszZ2Io=
-github.com/prometheus/common v0.62.0/go.mod h1:vyBcEuLSvWos9B1+CyL7JZ2up+uFzXhkqml0W5zIY1I=
+github.com/prometheus/common v0.63.0 h1:YR/EIY1o3mEFP/kZCD7iDMnLPlGyuU2Gb3HIcXnA98k=
+github.com/prometheus/common v0.63.0/go.mod h1:VVFF/fBIoToEnWRVkYoXEkq3R3paCoxG9PXP74SnV18=
 github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
 github.com/prometheus/procfs v0.0.0-20190507164030-5867b95ac084/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
 github.com/prometheus/procfs v0.0.2/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
@@ -1082,8 +1083,8 @@ github.com/redis/go-redis/extra/redisotel/v9 v9.0.5 h1:EfpWLLCyXw8PSM2/XNJLjI3Pb
 github.com/redis/go-redis/extra/redisotel/v9 v9.0.5/go.mod h1:WZjPDy7VNzn77AAfnAfVjZNvfJTYfPetfZk5yoSTLaQ=
 github.com/redis/go-redis/v9 v9.1.0 h1:137FnGdk+EQdCbye1FW+qOEcY5S+SpY9T0NiuqvtfMY=
 github.com/redis/go-redis/v9 v9.1.0/go.mod h1:urWj3He21Dj5k4TK1y59xH8Uj6ATueP8AH1cY3lZl4c=
-github.com/replicatedhq/troubleshoot v0.117.0 h1:FCw8VodGF/tetL7ZvdOhnjFDOvSDqMq/kce9/dsfHfc=
-github.com/replicatedhq/troubleshoot v0.117.0/go.mod h1:Xt6P84cvEyfyp9J/7EblCqINXHeTc+1zqfJY/KqjOss=
+github.com/replicatedhq/troubleshoot v0.118.0 h1:EFPbEcDtxoUpTblKv78FM2oiHLzUl8Re9w/5nBVptWI=
+github.com/replicatedhq/troubleshoot v0.118.0/go.mod h1:ggdOqOCp8UoQwUnvek8ybu9OphoQoN4zof596ghKMQw=
 github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
 github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ=
 github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88=
@@ -1129,8 +1130,8 @@ github.com/sergi/go-diff v1.3.1 h1:xkr+Oxo4BOQKmkn/B9eMK0g5Kg/983T9DqqPHwYqD+8=
 github.com/sergi/go-diff v1.3.1/go.mod h1:aMJSSKb2lpPvRNec0+w3fl7LP9IOFzdc9Pa4NFbPK1I=
 github.com/shirou/gopsutil/v3 v3.24.5 h1:i0t8kL+kQTvpAYToeuiVk3TgDeKOFioZO3Ztz/iZ9pI=
 github.com/shirou/gopsutil/v3 v3.24.5/go.mod h1:bsoOS1aStSs9ErQ1WWfxllSeS1K5D+U30r2NfcubMVk=
-github.com/shirou/gopsutil/v4 v4.25.1 h1:QSWkTc+fu9LTAWfkZwZ6j8MSUk4A2LV7rbH0ZqmLjXs=
-github.com/shirou/gopsutil/v4 v4.25.1/go.mod h1:RoUCUpndaJFtT+2zsZzzmhvbfGoDCJ7nFXKJf8GqJbI=
+github.com/shirou/gopsutil/v4 v4.25.2 h1:NMscG3l2CqtWFS86kj3vP7soOczqrQYIEhO/pMvvQkk=
+github.com/shirou/gopsutil/v4 v4.25.2/go.mod h1:34gBYJzyqCDT11b6bMHP0XCvWeU3J61XRT7a2EmCRTA=
 github.com/shoenig/go-m1cpu v0.1.6 h1:nxdKQNcEB6vzgA2E2bvzKIYRuNj7XNJ4S/aRSwKzFtM=
 github.com/shoenig/go-m1cpu v0.1.6/go.mod h1:1JJMcUBvfNwpq05QDQVAnx3gUHr9IYF7GNg9SUEw2VQ=
 github.com/shoenig/test v0.6.4 h1:kVTaSd7WLz5WZ2IaoM0RSzRsUD+m8wRR+5qvntpn4LU=
@@ -1365,42 +1366,42 @@ go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.5
 go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.58.0/go.mod h1:HDBUsEjOuRC0EzKZ1bSaRGZWUBAzo+MhAcUUORSr4D0=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.58.0 h1:yd02MEjBdJkG3uabWP9apV+OuWRIXGDuJEUJbOHmCFU=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.58.0/go.mod h1:umTcuxiv1n/s/S6/c2AT/g2CQ7u5C59sHDNmfSwgz7Q=
-go.opentelemetry.io/otel v1.34.0 h1:zRLXxLCgL1WyKsPVrgbSdMN4c0FMkDAskSTQP+0hdUY=
-go.opentelemetry.io/otel v1.34.0/go.mod h1:OWFPOQ+h4G8xpyjgqo4SxJYdDQ/qmRH+wivy7zzx9oI=
+go.opentelemetry.io/otel v1.35.0 h1:xKWKPxrxB6OtMCbmMY021CqC45J+3Onta9MqjhnusiQ=
+go.opentelemetry.io/otel v1.35.0/go.mod h1:UEqy8Zp11hpkUrL73gSlELM0DupHoiq72dR+Zqel/+Y=
 go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.8.0 h1:WzNab7hOOLzdDF/EoWCt4glhrbMPVMOO5JYTmpz36Ls=
 go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.8.0/go.mod h1:hKvJwTzJdp90Vh7p6q/9PAOd55dI6WA6sWj62a/JvSs=
 go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.8.0 h1:S+LdBGiQXtJdowoJoQPEtI52syEP/JYBUpjO49EQhV8=
 go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.8.0/go.mod h1:5KXybFvPGds3QinJWQT7pmXf+TN5YIa7CNYObWRkj50=
-go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.34.0 h1:ajl4QczuJVA2TU9W9AGw++86Xga/RKt//16z/yxPgdk=
-go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.34.0/go.mod h1:Vn3/rlOJ3ntf/Q3zAI0V5lDnTbHGaUsNUeF6nZmm7pA=
-go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.34.0 h1:opwv08VbCZ8iecIWs+McMdHRcAXzjAeda3uG2kI/hcA=
-go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.34.0/go.mod h1:oOP3ABpW7vFHulLpE8aYtNBodrHhMTrvfxUXGvqm7Ac=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.35.0 h1:QcFwRrZLc82r8wODjvyCbP7Ifp3UANaBSmhDSFjnqSc=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.35.0/go.mod h1:CXIWhUomyWBG/oY2/r/kLp6K/cmx9e/7DLpBuuGdLCA=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.35.0 h1:0NIXxOCFx+SKbhCVxwl3ETG8ClLPAa0KuKV6p3yhxP8=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.35.0/go.mod h1:ChZSJbbfbl/DcRZNc9Gqh6DYGlfjw4PvO1pEOZH1ZsE=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.32.0 h1:IJFEoHiytixx8cMiVAO+GmHR6Frwu+u5Ur8njpFO6Ac=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.32.0/go.mod h1:3rHrKNtLIoS0oZwkY2vxi+oJcwFRWdtUyRII+so45p8=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.32.0 h1:9kV11HXBHZAvuPUZxmMWrH8hZn/6UnHX4K0mu36vNsU=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.32.0/go.mod h1:JyA0FHXe22E1NeNiHmVp7kFHglnexDQ7uRWDiiJ1hKQ=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.33.0 h1:wpMfgF8E1rkrT1Z6meFh1NDtownE9Ii3n3X2GJYjsaU=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.33.0/go.mod h1:wAy0T/dUbs468uOlkT31xjvqQgEVXv58BRFWEgn5v/0=
-go.opentelemetry.io/otel/exporters/prometheus v0.56.0 h1:GnCIi0QyG0yy2MrJLzVrIM7laaJstj//flf1zEJCG+E=
-go.opentelemetry.io/otel/exporters/prometheus v0.56.0/go.mod h1:JQcVZtbIIPM+7SWBB+T6FK+xunlyidwLp++fN0sUaOk=
+go.opentelemetry.io/otel/exporters/prometheus v0.57.0 h1:AHh/lAP1BHrY5gBwk8ncc25FXWm/gmmY3BX258z5nuk=
+go.opentelemetry.io/otel/exporters/prometheus v0.57.0/go.mod h1:QpFWz1QxqevfjwzYdbMb4Y1NnlJvqSGwyuU0B4iuc9c=
 go.opentelemetry.io/otel/exporters/stdout/stdoutlog v0.8.0 h1:CHXNXwfKWfzS65yrlB2PVds1IBZcdsX8Vepy9of0iRU=
 go.opentelemetry.io/otel/exporters/stdout/stdoutlog v0.8.0/go.mod h1:zKU4zUgKiaRxrdovSS2amdM5gOc59slmo/zJwGX+YBg=
-go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.34.0 h1:czJDQwFrMbOr9Kk+BPo1y8WZIIFIK58SA1kykuVeiOU=
-go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.34.0/go.mod h1:lT7bmsxOe58Tq+JIOkTQMCGXdu47oA+VJKLZHbaBKbs=
+go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.35.0 h1:PB3Zrjs1sG1GBX51SXyTSoOTqcDglmsk7nT6tkKPb/k=
+go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.35.0/go.mod h1:U2R3XyVPzn0WX7wOIypPuptulsMcPDPs/oiSVOMVnHY=
 go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.32.0 h1:cC2yDI3IQd0Udsux7Qmq8ToKAx1XCilTQECZ0KDZyTw=
 go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.32.0/go.mod h1:2PD5Ex6z8CFzDbTdOlwyNIUywRr1DN0ospafJM1wJ+s=
 go.opentelemetry.io/otel/log v0.8.0 h1:egZ8vV5atrUWUbnSsHn6vB8R21G2wrKqNiDt3iWertk=
 go.opentelemetry.io/otel/log v0.8.0/go.mod h1:M9qvDdUTRCopJcGRKg57+JSQ9LgLBrwwfC32epk5NX8=
-go.opentelemetry.io/otel/metric v1.34.0 h1:+eTR3U0MyfWjRDhmFMxe2SsW64QrZ84AOhvqS7Y+PoQ=
-go.opentelemetry.io/otel/metric v1.34.0/go.mod h1:CEDrp0fy2D0MvkXE+dPV7cMi8tWZwX3dmaIhwPOaqHE=
-go.opentelemetry.io/otel/sdk v1.34.0 h1:95zS4k/2GOy069d321O8jWgYsW3MzVV+KuSPKp7Wr1A=
-go.opentelemetry.io/otel/sdk v1.34.0/go.mod h1:0e/pNiaMAqaykJGKbi+tSjWfNNHMTxoC9qANsCzbyxU=
+go.opentelemetry.io/otel/metric v1.35.0 h1:0znxYu2SNyuMSQT4Y9WDWej0VpcsxkuklLa4/siN90M=
+go.opentelemetry.io/otel/metric v1.35.0/go.mod h1:nKVFgxBZ2fReX6IlyW28MgZojkoAkJGaE8CpgeAU3oE=
+go.opentelemetry.io/otel/sdk v1.35.0 h1:iPctf8iprVySXSKJffSS79eOjl9pvxV9ZqOWT0QejKY=
+go.opentelemetry.io/otel/sdk v1.35.0/go.mod h1:+ga1bZliga3DxJ3CQGg3updiaAJoNECOgJREo9KHGQg=
 go.opentelemetry.io/otel/sdk/log v0.8.0 h1:zg7GUYXqxk1jnGF/dTdLPrK06xJdrXgqgFLnI4Crxvs=
 go.opentelemetry.io/otel/sdk/log v0.8.0/go.mod h1:50iXr0UVwQrYS45KbruFrEt4LvAdCaWWgIrsN3ZQggo=
-go.opentelemetry.io/otel/sdk/metric v1.34.0 h1:5CeK9ujjbFVL5c1PhLuStg1wxA7vQv7ce1EK0Gyvahk=
-go.opentelemetry.io/otel/sdk/metric v1.34.0/go.mod h1:jQ/r8Ze28zRKoNRdkjCZxfs6YvBTG1+YIqyFVFYec5w=
-go.opentelemetry.io/otel/trace v1.34.0 h1:+ouXS2V8Rd4hp4580a8q23bg0azF2nI8cqLYnC8mh/k=
-go.opentelemetry.io/otel/trace v1.34.0/go.mod h1:Svm7lSjQD7kG7KJ/MUHPVXSDGz2OX4h0M2jHBhmSfRE=
+go.opentelemetry.io/otel/sdk/metric v1.35.0 h1:1RriWBmCKgkeHEhM7a2uMjMUfP7MsOF5JpUCaEqEI9o=
+go.opentelemetry.io/otel/sdk/metric v1.35.0/go.mod h1:is6XYCUMpcKi+ZsOvfluY5YstFnhW0BidkR+gL+qN+w=
+go.opentelemetry.io/otel/trace v1.35.0 h1:dPpEfJu1sDIqruz7BHFG3c7528f6ddfSWfFDVt/xgMs=
+go.opentelemetry.io/otel/trace v1.35.0/go.mod h1:WUk7DtFp1Aw2MkvqGdwiXYDZZNvA/1J8o6xRXLrIkyc=
 go.opentelemetry.io/proto/otlp v1.5.0 h1:xJvq7gMzB31/d406fB8U5CBdyQGw4P399D1aQWU/3i4=
 go.opentelemetry.io/proto/otlp v1.5.0/go.mod h1:keN8WnHxOy8PG0rQZjJJ5A2ebUoafqWp0eVQ4yIXvJ4=
 go.uber.org/atomic v1.3.2/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
@@ -1653,10 +1654,10 @@ google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98
 google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
 google.golang.org/genproto v0.0.0-20241118233622-e639e219e697 h1:ToEetK57OidYuqD4Q5w+vfEnPvPpuTwedCNVohYJfNk=
 google.golang.org/genproto v0.0.0-20241118233622-e639e219e697/go.mod h1:JJrvXBWRZaFMxBufik1a4RpFw4HhgVtBBWQeQgUj2cc=
-google.golang.org/genproto/googleapis/api v0.0.0-20250115164207-1a7da9e5054f h1:gap6+3Gk41EItBuyi4XX/bp4oqJ3UwuIMl25yGinuAA=
-google.golang.org/genproto/googleapis/api v0.0.0-20250115164207-1a7da9e5054f/go.mod h1:Ic02D47M+zbarjYYUlK57y316f2MoN0gjAwI3f2S95o=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20250212204824-5a70512c5d8b h1:FQtJ1MxbXoIIrZHZ33M+w5+dAP9o86rgpjoKr/ZmT7k=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20250212204824-5a70512c5d8b/go.mod h1:8BS3B93F/U1juMFq9+EDk+qOT5CO1R9IzXxG3PTqiRk=
+google.golang.org/genproto/googleapis/api v0.0.0-20250218202821-56aae31c358a h1:nwKuGPlUAt+aR+pcrkfFRrTU1BVrSmYyYMxYbUIVHr0=
+google.golang.org/genproto/googleapis/api v0.0.0-20250218202821-56aae31c358a/go.mod h1:3kWAYMk1I75K4vykHtKt2ycnOgpA6974V7bREqbsenU=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250218202821-56aae31c358a h1:51aaUVRocpvUOSQKM6Q7VuoaktNIaMCLuhZB6DKksq4=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250218202821-56aae31c358a/go.mod h1:uRxBH1mhmO8PGhU89cMcHaXKZqO+OfakD8QQO0oYwlQ=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.21.0/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM=
 google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
@@ -1720,8 +1721,8 @@ gotest.tools v2.2.0+incompatible h1:VsBPFP1AI068pPrMxtb/S8Zkgf9xEmTLJjfM+P5UIEo=
 gotest.tools v2.2.0+incompatible/go.mod h1:DsYFclhRJ6vuDpmuTbkuFWG+y2sxOXAzmJt81HFBacw=
 gotest.tools/v3 v3.5.1 h1:EENdUnS3pdur5nybKYIh2Vfgc8IUNBjxDPSjtiJcOzU=
 gotest.tools/v3 v3.5.1/go.mod h1:isy3WKz7GK6uNw/sbHzfKBLvlvXwUyV06n6brMxxopU=
-helm.sh/helm/v3 v3.17.1 h1:gzVoAD+qVuoJU6KDMSAeo0xRJ6N1znRxz3wyuXRmJDk=
-helm.sh/helm/v3 v3.17.1/go.mod h1:nvreuhuR+j78NkQcLC3TYoprCKStLyw5P4T7E5itv2w=
+helm.sh/helm/v3 v3.17.2 h1:agYQ5ew2jq5vdx2K7q5W44KyKQrnSubUMCQsjkiv3/o=
+helm.sh/helm/v3 v3.17.2/go.mod h1:+uJKMH/UiMzZQOALR3XUf3BLIoczI2RKKD6bMhPh4G8=
 honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190106161140-3f1c8253044a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
diff --git a/internal/cmd/egctl/config_cmd.go b/internal/cmd/egctl/config_cmd.go
index 242706f6d..976ebaa96 100644
--- a/internal/cmd/egctl/config_cmd.go
+++ b/internal/cmd/egctl/config_cmd.go
@@ -25,8 +25,7 @@ func newConfigCommand() *cobra.Command {
 	cfgCommand.AddCommand(proxyCommand())
 	cfgCommand.AddCommand(ratelimitCommand())
 
-	flags := cfgCommand.Flags()
-	options.AddKubeConfigFlags(flags)
+	options.AddKubeConfigFlags(cfgCommand.PersistentFlags())
 
 	cfgCommand.PersistentFlags().StringVarP(&output, "output", "o", "json", "One of 'yaml' or 'json'")
 	cfgCommand.PersistentFlags().StringVarP(&podNamespace, "namespace", "n", "envoy-gateway-system", "Namespace where envoy proxy pod are installed.")
diff --git a/internal/gatewayapi/ext_service.go b/internal/gatewayapi/ext_service.go
index 4eecdaa29..c041cdc4e 100644
--- a/internal/gatewayapi/ext_service.go
+++ b/internal/gatewayapi/ext_service.go
@@ -73,6 +73,9 @@ func (t *Translator) translateExtServiceBackendRefs(
 		Name:     destName,
 		Settings: ds,
 	}
+	if validationErr := rs.Validate(); validationErr != nil {
+		return nil, validationErr
+	}
 	return rs, nil
 }
 
diff --git a/internal/gatewayapi/route.go b/internal/gatewayapi/route.go
index 60ece038e..f39402b3d 100644
--- a/internal/gatewayapi/route.go
+++ b/internal/gatewayapi/route.go
@@ -16,6 +16,7 @@ import (
 	corev1 "k8s.io/api/core/v1"
 	discoveryv1 "k8s.io/api/discovery/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/util/sets"
 	"k8s.io/utils/ptr"
 	gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
 	gwapiv1a2 "sigs.k8s.io/gateway-api/apis/v1alpha2"
@@ -203,13 +204,13 @@ func (t *Translator) processHTTPRouteRules(httpRoute *HTTPRouteContext, parentRe
 			return nil, err
 		}
 
-		dstAddrTypeMap := make(map[ir.DestinationAddressType]int)
+		dstAddrTypeSet := make(sets.Set[ir.DestinationAddressType])
 		destName := irRouteDestinationName(httpRoute, ruleIdx)
 		for i, backendRef := range rule.BackendRefs {
 			settingName := irDestinationSettingName(destName, i)
 			ds, err := t.processDestination(settingName, backendRef, parentRef, httpRoute, resources)
 			if !t.IsEnvoyServiceRouting(envoyProxy) && ds != nil && len(ds.Endpoints) > 0 && ds.AddressType != nil {
-				dstAddrTypeMap[*ds.AddressType]++
+				dstAddrTypeSet.Insert(*ds.AddressType)
 			}
 
 			for _, route := range ruleRoutes {
@@ -240,7 +241,7 @@ func (t *Translator) processHTTPRouteRules(httpRoute *HTTPRouteContext, parentRe
 		}
 
 		// TODO: support mixed endpointslice address type between backendRefs
-		if !t.IsEnvoyServiceRouting(envoyProxy) && len(dstAddrTypeMap) > 1 {
+		if !t.IsEnvoyServiceRouting(envoyProxy) && (dstAddrTypeSet.Len() > 1 || dstAddrTypeSet.Has(ir.MIXED)) {
 			routeStatus := GetRouteStatus(httpRoute)
 			status.SetRouteStatusCondition(routeStatus,
 				parentRef.routeParentStatusIdx,
diff --git a/internal/gatewayapi/runner/runner.go b/internal/gatewayapi/runner/runner.go
index f5446a7dd..c90c3ba96 100644
--- a/internal/gatewayapi/runner/runner.go
+++ b/internal/gatewayapi/runner/runner.go
@@ -15,6 +15,7 @@ import (
 	"reflect"
 
 	"github.com/docker/docker/pkg/fileutils"
+	"github.com/telepresenceio/watchable"
 	kerrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime/schema"
@@ -81,7 +82,8 @@ func (r *Runner) Start(ctx context.Context) (err error) {
 	r.Logger = r.Logger.WithName(r.Name()).WithValues("runner", r.Name())
 
 	go r.startWasmCache(ctx)
-	go r.subscribeAndTranslate(ctx)
+	c := r.ProviderResources.GatewayAPIResources.Subscribe(ctx)
+	go r.subscribeAndTranslate(c)
 	r.Logger.Info("started")
 	return
 }
@@ -117,8 +119,8 @@ func (r *Runner) startWasmCache(ctx context.Context) {
 	r.wasmCache.Start(ctx)
 }
 
-func (r *Runner) subscribeAndTranslate(ctx context.Context) {
-	message.HandleSubscription(message.Metadata{Runner: string(egv1a1.LogComponentGatewayAPIRunner), Message: "provider-resources"}, r.ProviderResources.GatewayAPIResources.Subscribe(ctx),
+func (r *Runner) subscribeAndTranslate(sub <-chan watchable.Snapshot[string, *resource.ControllerResources]) {
+	message.HandleSubscription(message.Metadata{Runner: string(egv1a1.LogComponentGatewayAPIRunner), Message: "provider-resources"}, sub,
 		func(update message.Update[string, *resource.ControllerResources], errChan chan error) {
 			r.Logger.Info("received an update")
 			val := update.Value
diff --git a/internal/infrastructure/runner/runner.go b/internal/infrastructure/runner/runner.go
index 6896a6e5a..72beff9c2 100644
--- a/internal/infrastructure/runner/runner.go
+++ b/internal/infrastructure/runner/runner.go
@@ -8,6 +8,7 @@ package runner
 import (
 	"context"
 
+	"github.com/telepresenceio/watchable"
 	"k8s.io/utils/ptr"
 
 	egv1a1 "github.com/envoyproxy/gateway/api/v1alpha1"
@@ -50,8 +51,9 @@ func (r *Runner) Start(ctx context.Context) (err error) {
 		return err
 	}
 
+	sub := r.InfraIR.Subscribe(ctx)
 	initInfra := func() {
-		go r.subscribeToProxyInfraIR(ctx)
+		go r.subscribeToProxyInfraIR(ctx, sub)
 
 		// Enable global ratelimit if it has been configured.
 		if r.EnvoyGateway.RateLimit != nil {
@@ -85,9 +87,9 @@ func (r *Runner) Start(ctx context.Context) (err error) {
 	return
 }
 
-func (r *Runner) subscribeToProxyInfraIR(ctx context.Context) {
+func (r *Runner) subscribeToProxyInfraIR(ctx context.Context, sub <-chan watchable.Snapshot[string, *ir.Infra]) {
 	// Subscribe to resources
-	message.HandleSubscription(message.Metadata{Runner: string(egv1a1.LogComponentInfrastructureRunner), Message: "infra-ir"}, r.InfraIR.Subscribe(ctx),
+	message.HandleSubscription(message.Metadata{Runner: string(egv1a1.LogComponentInfrastructureRunner), Message: "infra-ir"}, sub,
 		func(update message.Update[string, *ir.Infra], errChan chan error) {
 			r.Logger.Info("received an update")
 			val := update.Value
diff --git a/internal/ir/xds.go b/internal/ir/xds.go
index 9986a0240..40801926a 100644
--- a/internal/ir/xds.go
+++ b/internal/ir/xds.go
@@ -43,6 +43,7 @@ var (
 	ErrTLSPrivateKey                            = errors.New("field PrivateKey must be specified")
 	ErrRouteNameEmpty                           = errors.New("field Name must be specified")
 	ErrHTTPRouteHostnameEmpty                   = errors.New("field Hostname must be specified")
+	ErrRouteDestinationsFQDNMixed               = errors.New("mixed endpoints address type for the same route destination is not supported")
 	ErrDestinationNameEmpty                     = errors.New("field Name must be specified")
 	ErrDestEndpointHostInvalid                  = errors.New("field Address must be a valid IP or FQDN address")
 	ErrDestEndpointPortInvalid                  = errors.New("field Port specified is invalid")
@@ -1429,10 +1430,17 @@ func (r *RouteDestination) Validate() error {
 	if len(r.Name) == 0 {
 		errs = errors.Join(errs, ErrDestinationNameEmpty)
 	}
+	routeHasAddressTypes := make(sets.Set[DestinationAddressType])
 	for _, s := range r.Settings {
 		if err := s.Validate(); err != nil {
 			errs = errors.Join(errs, err)
 		}
+		if s.AddressType != nil {
+			routeHasAddressTypes.Insert(*s.AddressType)
+		}
+	}
+	if routeHasAddressTypes.Len() > 1 || routeHasAddressTypes.Has(MIXED) {
+		errs = errors.Join(ErrRouteDestinationsFQDNMixed)
 	}
 
 	return errs
diff --git a/internal/provider/kubernetes/controller.go b/internal/provider/kubernetes/controller.go
index 9ed0445fe..07370f27e 100644
--- a/internal/provider/kubernetes/controller.go
+++ b/internal/provider/kubernetes/controller.go
@@ -215,8 +215,7 @@ func (r *gatewayAPIReconciler) Reconcile(ctx context.Context, _ reconcile.Reques
 					string(gwapiv1.GatewayClassReasonInvalidParameters),
 					msg)
 				r.resources.GatewayClassStatuses.Store(utils.NamespacedName(gc), &gc.Status)
-				r.log.Error(err, "failed to process parametersRef for gatewayclass", "name", managedGC.Name)
-				return reconcile.Result{}, err
+				return reconcile.Result{}, nil
 			}
 		}
 
diff --git a/internal/xds/server/runner/runner.go b/internal/xds/server/runner/runner.go
index bd2e0c64e..d73cb7ccd 100644
--- a/internal/xds/server/runner/runner.go
+++ b/internal/xds/server/runner/runner.go
@@ -21,6 +21,7 @@ import (
 	runtimev3 "github.com/envoyproxy/go-control-plane/envoy/service/runtime/v3"
 	secretv3 "github.com/envoyproxy/go-control-plane/envoy/service/secret/v3"
 	serverv3 "github.com/envoyproxy/go-control-plane/pkg/server/v3"
+	"github.com/telepresenceio/watchable"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials"
 	"google.golang.org/grpc/keepalive"
@@ -100,7 +101,10 @@ func (r *Runner) Start(ctx context.Context) (err error) {
 	go r.serveXdsServer(ctx)
 
 	// Start message Subscription.
-	go r.subscribeAndTranslate(ctx)
+	// Do not call .Subscribe() inside Goroutine since it is supposed to be called from the same
+	// Goroutine where Close() is called.
+	xdsSubCh := r.Xds.Subscribe(ctx)
+	go r.subscribeAndTranslate(xdsSubCh)
 	r.Logger.Info("started")
 	return
 }
@@ -141,9 +145,8 @@ func registerServer(srv serverv3.Server, g *grpc.Server) {
 	runtimev3.RegisterRuntimeDiscoveryServiceServer(g, srv)
 }
 
-func (r *Runner) subscribeAndTranslate(ctx context.Context) {
-	// Subscribe to resources
-	message.HandleSubscription(message.Metadata{Runner: string(egv1a1.LogComponentXdsServerRunner), Message: "xds"}, r.Xds.Subscribe(ctx),
+func (r *Runner) subscribeAndTranslate(sub <-chan watchable.Snapshot[string, *xdstypes.ResourceVersionTable]) {
+	message.HandleSubscription(message.Metadata{Runner: string(egv1a1.LogComponentXdsServerRunner), Message: "xds"}, sub,
 		func(update message.Update[string, *xdstypes.ResourceVersionTable], errChan chan error) {
 			key := update.Key
 			val := update.Value
diff --git a/internal/xds/translator/runner/runner.go b/internal/xds/translator/runner/runner.go
index 6c802a76f..faa4a65ec 100644
--- a/internal/xds/translator/runner/runner.go
+++ b/internal/xds/translator/runner/runner.go
@@ -9,6 +9,7 @@ import (
 	"context"
 	"reflect"
 
+	"github.com/telepresenceio/watchable"
 	ktypes "k8s.io/apimachinery/pkg/types"
 
 	egv1a1 "github.com/envoyproxy/gateway/api/v1alpha1"
@@ -43,14 +44,15 @@ func (r *Runner) Name() string {
 // Start starts the xds-translator runner
 func (r *Runner) Start(ctx context.Context) (err error) {
 	r.Logger = r.Logger.WithName(r.Name()).WithValues("runner", r.Name())
-	go r.subscribeAndTranslate(ctx)
+	sub := r.XdsIR.Subscribe(ctx)
+	go r.subscribeAndTranslate(sub)
 	r.Logger.Info("started")
 	return
 }
 
-func (r *Runner) subscribeAndTranslate(ctx context.Context) {
+func (r *Runner) subscribeAndTranslate(sub <-chan watchable.Snapshot[string, *ir.Xds]) {
 	// Subscribe to resources
-	message.HandleSubscription(message.Metadata{Runner: string(egv1a1.LogComponentXdsTranslatorRunner), Message: "xds-ir"}, r.XdsIR.Subscribe(ctx),
+	message.HandleSubscription(message.Metadata{Runner: string(egv1a1.LogComponentXdsTranslatorRunner), Message: "xds-ir"}, sub,
 		func(update message.Update[string, *ir.Xds], errChan chan error) {
 			r.Logger.Info("received an update")
 			key := update.Key
diff --git a/release-notes/current.yaml b/release-notes/current.yaml
index c995a3e06..08c25ee2e 100644
--- a/release-notes/current.yaml
+++ b/release-notes/current.yaml
@@ -33,6 +33,7 @@ bug fixes: |
   Fix an issue that stats compressor was not working.
   Added support for BackendTLSPolicy and EnvoyExtensionPolicy parsing in Standalone mode.
   Retrigger reconciliation when backendRef of type ServiceImport is updated or when EndpointSlice(s) for a ServiceImport are updated.
+  Fix not logging an error and returning it in the K8s Reconcile method when a GatewayClass is not accepted.
 
 # Enhancements that improve performance.
 performance improvements: |
diff --git a/release-notes/v1.3.1.yaml b/release-notes/v1.3.1.yaml
index 60abd6cb3..13be392a1 100644
--- a/release-notes/v1.3.1.yaml
+++ b/release-notes/v1.3.1.yaml
@@ -26,4 +26,4 @@ Other changes: |
   Bump ratelimit to ae4cee11.
   Bump golang.org/x/oauth2 to v0.27.0.
   Bump golang.org/x/crypto to v0.35.0.
-
+  Added Ecosystem section to docs
diff --git a/site/content/en/_index.md b/site/content/en/_index.md
index 17342bdf5..62f443051 100644
--- a/site/content/en/_index.md
+++ b/site/content/en/_index.md
@@ -119,3 +119,5 @@ no_list: true
 </section>
 
 {{< adopters >}}
+
+{{< ecosystem >}}
diff --git a/site/content/en/contributions/ECOSYSTEM.md b/site/content/en/contributions/ECOSYSTEM.md
new file mode 100644
index 000000000..211eb8172
--- /dev/null
+++ b/site/content/en/contributions/ECOSYSTEM.md
@@ -0,0 +1,34 @@
+---
+title: "Open Source Ecosystem"
+description: "Join the Envoy Gateway Open Source Ecosystem"
+---
+
+# Envoy Gateway OSS Ecosystem 🌐
+
+[Envoy Gateway](https://gateway.envoyproxy.io) powers modern API gateway solutions while embracing the collaborative spirit of open source. This section highlights projects that extend, integrate with, or leverage Envoy Gateway's capabilities.
+
+## Why Add Your Project?
+By listing your open source project here, you help:
+
+🌱 **Boost Visibility** - Showcase how your project interacts with Envoy Gateway to thousands of cloud-native developers  
+🤝 **Encourage Collaboration** - Attract contributors and foster interoperability within the ecosystem  
+
+## How to List Your Project
+Add your project to this ecosystem directory in 4 steps:
+
+1. **Fork the Repository** - Clone the [Envoy Gateway website repo](https://github.com/envoyproxy/gateway)
+2. **Add Project Assets**
+   - Place your project logo in `site/static/logos` (SVG/PNG, 400x200px recommended)
+3. **Update Ecosystem Data** - Add your project details in `site/data/ecosystem.yaml`
+4. **Open a PR** - Create a pull request for review by maintainers
+
+### Example Entry
+
+```yaml
+- name:        Project Name
+  url:        https://project-docs.io
+  logo:        /logos/your-project-logo.svg
+  description: |
+    Concise technical description of how your project integrates with Envoy Gateway.
+    Example: "XDS controller for custom Envoy Gateway configurations"
+```
diff --git a/site/data/ecosystem.yaml b/site/data/ecosystem.yaml
new file mode 100644
index 000000000..58b1f3d93
--- /dev/null
+++ b/site/data/ecosystem.yaml
@@ -0,0 +1,5 @@
+adopters:
+  - name: "Envoy AI Gateway"
+    logo: "/logos/envoy-ai-gateway.svg"
+    url: "https://aigateway.envoyproxy.io"
+    description: "Envoy AI Gateway is built on top of Envoy Gateway to handle request traffic from application services to Gen AI services."
diff --git a/site/go.mod b/site/go.mod
index 2e4f9b4e8..7f17f3bff 100644
--- a/site/go.mod
+++ b/site/go.mod
@@ -1,6 +1,6 @@
 module github.com/google/docsy-example
 
-go 1.24.0
+go 1.24.1
 
 require (
 	github.com/FortAwesome/Font-Awesome v0.0.0-20240402185447-c0f460dca7f7 // indirect
diff --git a/site/layouts/shortcodes/ecosystem.html b/site/layouts/shortcodes/ecosystem.html
new file mode 100644
index 000000000..837d6f2a5
--- /dev/null
+++ b/site/layouts/shortcodes/ecosystem.html
@@ -0,0 +1,14 @@
+{{ $adopters := .Site.Data.ecosystem.adopters }}
+<section class="adopters-section">
+  <h2 class="text-center mb-5">Open Source Ecosystem</h2>
+  <div class="adopters-list">
+    {{ range $adopters }}
+    <a class="adopter" href="{{ .url }}" target="_blank" rel="noopener noreferrer">
+      <img src="{{ .logo | relURL }}" alt="{{ .name }} logo" loading="lazy">
+      <div class="adopter-info">
+        <p>{{ .description }}</p>
+      </div>
+    </a>
+    {{ end }}
+  </div>
+</section>
diff --git a/site/static/logos/envoy-ai-gateway.svg b/site/static/logos/envoy-ai-gateway.svg
new file mode 100644
index 000000000..4eb645dc1
--- /dev/null
+++ b/site/static/logos/envoy-ai-gateway.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="1280" zoomAndPan="magnify" viewBox="0 0 960 479.999983" height="640" preserveAspectRatio="xMidYMid meet" version="1.0"><defs><g/></defs><rect x="-96" width="1152" fill="#ffffff" y="-47.999998" height="575.99998" fill-opacity="1"/><rect x="-96" width="1152" fill="#fffffe" y="-47.999998" height="575.99998" fill-opacity="1"/><path fill="#6c1899" d="M 127.652344 235.308594 L 128.195312 258.324219 L 152.386719 273.273438 L 151.84375 250.257812 Z M 186.730469 330.8125 L 186.1875 308.34375 L 164.984375 295.203125 C 164.710938 295.023438 164.347656 294.75 164.078125 294.570312 L 164.621094 317.132812 Z M 111.160156 361.167969 L 55.796875 326.828125 L 54.4375 269.289062 L 81.527344 257.597656 L 80.984375 234.582031 L 37.671875 253.25 C 34.320312 254.699219 32.328125 257.78125 32.417969 261.3125 L 34.046875 330.359375 C 34.140625 333.894531 36.3125 337.429688 39.757812 339.511719 L 106.175781 380.652344 C 109.257812 382.554688 112.972656 383.097656 116.144531 382.101562 C 116.503906 382.007812 116.777344 381.917969 117.050781 381.738281 L 157.824219 364.160156 L 135.714844 350.476562 Z M 290.027344 233.949219 C 289.9375 229.78125 287.398438 225.703125 283.414062 223.257812 L 202.859375 173.328125 L 200.414062 174.417969 L 200.957031 198.609375 L 264.746094 238.117188 L 266.289062 302.816406 L 290.664062 317.945312 L 292.019531 317.402344 Z M 290.027344 233.949219 " fill-opacity="1" fill-rule="nonzero"/><path fill="#6c1899" d="M 193.527344 347.488281 L 118.679688 301.09375 L 116.867188 223.167969 L 150.9375 208.488281 L 150.304688 181.667969 L 97.386719 204.5 C 93.488281 206.222656 91.132812 209.757812 91.226562 213.925781 L 93.398438 305.261719 C 93.488281 309.429688 96.027344 313.507812 100.015625 315.953125 L 187.726562 370.320312 C 191.351562 372.585938 195.699219 373.128906 199.324219 372.042969 C 199.6875 371.953125 200.050781 371.769531 200.414062 371.589844 L 252.242188 349.207031 L 226.507812 333.261719 Z M 193.527344 347.488281 " fill-opacity="1" fill-rule="nonzero"/><path fill="#6c1899" d="M 404.109375 170.066406 L 291.566406 100.296875 C 287.398438 97.757812 282.507812 97.035156 278.25 98.394531 C 277.796875 98.484375 277.433594 98.664062 276.980469 98.847656 L 167.25 146.144531 C 162.808594 148.050781 160.089844 152.125 160.269531 156.929688 L 162.988281 274 C 163.082031 278.710938 165.980469 283.421875 170.511719 286.234375 L 283.050781 355.914062 C 287.21875 358.449219 292.113281 359.175781 296.371094 357.816406 C 296.824219 357.726562 297.1875 357.542969 297.640625 357.363281 L 407.371094 310.0625 C 411.8125 308.160156 414.4375 304.082031 414.347656 299.28125 L 411.628906 182.210938 C 411.539062 177.496094 408.640625 172.875 404.109375 170.066406 Z M 289.757812 329.816406 L 191.984375 269.199219 L 189.539062 167.53125 L 284.953125 126.394531 L 382.722656 187.011719 L 385.171875 288.679688 Z M 289.757812 329.816406 " fill-opacity="1" fill-rule="nonzero"/><path fill="#43105f" d="M 560.832031 230.835938 C 560.710938 227.273438 560.148438 224.007812 559.136719 221.035156 C 558.128906 218.070312 556.617188 215.488281 554.597656 213.289062 C 552.574219 211.09375 550.054688 209.367188 547.027344 208.125 C 543.996094 206.878906 540.464844 206.25 536.425781 206.25 C 532.507812 206.25 528.917969 206.992188 525.652344 208.476562 C 522.382812 209.964844 519.621094 211.894531 517.367188 214.269531 C 515.136719 216.59375 513.386719 219.238281 512.109375 222.195312 C 510.863281 225.105469 510.242188 227.984375 510.242188 230.835938 Z M 510.242188 243.660156 C 510.242188 247.34375 511.042969 250.699219 512.644531 253.726562 C 514.226562 256.738281 516.335938 259.320312 518.96875 261.476562 C 521.578125 263.613281 524.609375 265.277344 528.054688 266.460938 C 531.515625 267.660156 535.078125 268.253906 538.742188 268.242188 C 543.730469 268.242188 548.0625 267.085938 551.75 264.769531 C 555.425781 262.457031 558.8125 259.398438 561.902344 255.597656 L 574.015625 264.859375 C 565.105469 276.378906 552.636719 282.140625 536.605469 282.140625 C 529.953125 282.140625 523.925781 281.007812 518.523438 278.753906 C 513.121094 276.5 508.546875 273.382812 504.808594 269.402344 C 501.070312 265.425781 498.183594 260.734375 496.167969 255.332031 C 494.148438 249.925781 493.140625 244.078125 493.140625 237.78125 C 493.140625 231.488281 494.238281 225.640625 496.4375 220.234375 C 498.632812 214.835938 501.660156 210.144531 505.519531 206.164062 C 509.378906 202.183594 513.980469 199.066406 519.328125 196.808594 C 524.667969 194.554688 530.488281 193.425781 536.785156 193.425781 C 544.265625 193.425781 550.589844 194.734375 555.753906 197.347656 C 560.921875 199.957031 565.164062 203.371094 568.492188 207.589844 C 571.816406 211.804688 574.222656 216.558594 575.707031 221.839844 C 577.191406 227.109375 577.933594 232.484375 577.933594 237.960938 L 577.933594 243.660156 Z M 591.824219 195.5625 L 607.855469 195.5625 L 607.855469 208.566406 L 608.210938 208.566406 C 610.230469 204.054688 613.734375 200.402344 618.722656 197.613281 C 623.710938 194.824219 629.46875 193.425781 636 193.425781 C 640.039062 193.425781 643.929688 194.050781 647.667969 195.296875 C 651.410156 196.546875 654.675781 198.476562 657.464844 201.085938 C 660.253906 203.699219 662.480469 207.054688 664.148438 211.152344 C 665.808594 215.246094 666.640625 220.089844 666.640625 225.667969 L 666.640625 280.003906 L 650.605469 280.003906 L 650.605469 230.125 C 650.605469 226.203125 650.074219 222.847656 649.007812 220.058594 C 647.9375 217.269531 646.511719 215.011719 644.726562 213.289062 C 642.96875 211.570312 640.917969 210.324219 638.582031 209.546875 C 636.242188 208.769531 633.839844 208.382812 631.371094 208.390625 C 628.042969 208.390625 624.957031 208.925781 622.105469 209.992188 C 619.253906 211.0625 616.761719 212.753906 614.621094 215.070312 C 612.484375 217.386719 610.820312 220.324219 609.636719 223.886719 C 608.449219 227.453125 607.855469 231.667969 607.855469 236.535156 L 607.855469 280.003906 L 591.824219 280.003906 L 591.824219 195.5625 M 671.792969 195.5625 L 690.335938 195.5625 L 715.632812 260.230469 L 739.855469 195.5625 L 756.949219 195.5625 L 723.816406 279.992188 L 706.179688 279.992188 L 671.792969 195.5625 M 775.128906 237.78125 C 775.128906 242.058594 775.78125 246.007812 777.089844 249.628906 C 778.394531 253.253906 780.234375 256.339844 782.613281 258.894531 C 784.984375 261.445312 787.894531 263.464844 791.339844 264.949219 C 794.785156 266.4375 798.644531 267.175781 802.917969 267.175781 C 807.195312 267.175781 811.050781 266.4375 814.496094 264.949219 C 817.941406 263.464844 820.847656 261.445312 823.226562 258.894531 C 825.601562 256.339844 827.441406 253.253906 828.75 249.628906 C 830.054688 246.007812 830.710938 242.058594 830.710938 237.78125 C 830.710938 233.507812 830.054688 229.558594 828.75 225.9375 C 827.441406 222.316406 825.601562 219.226562 823.226562 216.671875 C 820.847656 214.121094 817.941406 212.105469 814.496094 210.617188 C 811.050781 209.132812 807.195312 208.390625 802.917969 208.390625 C 798.644531 208.390625 794.785156 209.132812 791.339844 210.617188 C 787.894531 212.105469 784.984375 214.121094 782.613281 216.671875 C 780.234375 219.226562 778.394531 222.316406 777.089844 225.9375 C 775.78125 229.558594 775.128906 233.507812 775.128906 237.78125 Z M 758.027344 237.78125 C 758.027344 231.609375 759.1875 225.847656 761.5 220.503906 C 763.816406 215.160156 766.992188 210.46875 771.03125 206.429688 C 775.066406 202.394531 779.820312 199.214844 785.285156 196.898438 C 790.746094 194.582031 796.621094 193.425781 802.917969 193.425781 C 809.210938 193.425781 815.089844 194.582031 820.554688 196.898438 C 826.015625 199.214844 830.769531 202.394531 834.808594 206.429688 C 838.882812 210.511719 842.0625 215.203125 844.339844 220.503906 C 846.652344 225.847656 847.8125 231.609375 847.8125 237.78125 C 847.8125 243.957031 846.652344 249.75 844.339844 255.152344 C 842.019531 260.558594 838.84375 265.246094 834.808594 269.226562 C 830.769531 273.203125 826.015625 276.347656 820.554688 278.667969 C 815.089844 280.980469 809.210938 282.140625 802.917969 282.140625 C 796.621094 282.140625 790.746094 280.980469 785.285156 278.667969 C 779.820312 276.347656 775.066406 273.203125 771.03125 269.226562 C 766.992188 265.246094 763.816406 260.558594 761.5 255.152344 C 759.1875 249.75 758.027344 243.957031 758.027344 237.78125 Z M 849.054688 195.5625 L 867.582031 195.5625 L 892.585938 261.476562 L 892.945312 261.476562 L 916.929688 195.5625 L 934.027344 195.5625 L 893.949219 298.171875 C 892.636719 301.601562 891.160156 304.957031 889.511719 308.238281 C 887.976562 311.261719 886.140625 313.847656 884.015625 315.988281 C 881.882812 318.125 879.3125 319.785156 876.292969 320.972656 C 873.277344 322.160156 869.582031 322.753906 865.207031 322.753906 C 862.839844 322.753906 860.445312 322.605469 858.023438 322.308594 C 855.597656 322.015625 853.265625 321.390625 851.015625 320.441406 L 852.964844 305.832031 C 856.148438 307.136719 859.335938 307.789062 862.523438 307.789062 C 865 307.789062 867.09375 307.460938 868.804688 306.8125 C 870.488281 306.179688 871.960938 305.230469 873.230469 303.960938 C 874.5 302.671875 875.53125 301.21875 876.328125 299.597656 C 877.152344 297.933594 877.980469 296.035156 878.808594 293.894531 L 883.996094 280.535156 L 849.054688 195.5625 " fill-opacity="1" fill-rule="evenodd"/><path fill="#43105f" d="M 609.386719 334.378906 C 609.386719 339.910156 607.972656 344.105469 605.144531 346.984375 C 602.3125 349.855469 598.222656 351.292969 592.859375 351.292969 C 589.875 351.292969 587.1875 350.859375 584.789062 349.996094 C 582.394531 349.132812 580.113281 347.636719 577.953125 345.523438 L 581.582031 341.371094 C 583.183594 343.097656 584.875 344.410156 586.667969 345.292969 C 588.460938 346.175781 590.523438 346.621094 592.859375 346.621094 C 595.199219 346.621094 596.976562 346.285156 598.464844 345.621094 C 599.953125 344.949219 601.132812 344.039062 601.996094 342.902344 C 602.859375 341.753906 603.464844 340.449219 603.808594 338.980469 C 604.148438 337.511719 604.328125 335.976562 604.328125 334.378906 L 604.328125 330.492188 L 604.195312 330.492188 C 602.984375 332.433594 601.410156 333.863281 599.46875 334.765625 C 597.523438 335.675781 595.535156 336.128906 593.503906 336.128906 C 591.128906 336.128906 588.945312 335.742188 586.957031 334.964844 C 584.96875 334.1875 583.261719 333.105469 581.839844 331.722656 C 580.417969 330.339844 579.308594 328.699219 578.53125 326.796875 C 577.753906 324.890625 577.367188 322.824219 577.367188 320.570312 C 577.367188 318.105469 577.753906 315.878906 578.53125 313.898438 C 579.308594 311.910156 580.402344 310.234375 581.808594 308.878906 C 583.210938 307.515625 584.910156 306.46875 586.890625 305.738281 C 588.882812 305.003906 591.082031 304.636719 593.503906 304.636719 C 594.539062 304.636719 595.582031 304.753906 596.613281 304.992188 C 597.648438 305.230469 598.65625 305.597656 599.632812 306.09375 C 600.605469 306.585938 601.476562 307.21875 602.253906 307.96875 C 603.03125 308.726562 603.683594 309.601562 604.195312 310.589844 L 604.328125 310.589844 L 604.328125 305.40625 L 609.378906 305.40625 L 609.378906 334.378906 Z M 582.816406 320.578125 C 582.816406 322.132812 583.097656 323.566406 583.65625 324.886719 C 584.21875 326.203125 584.988281 327.347656 585.957031 328.316406 C 586.933594 329.292969 588.066406 330.054688 589.363281 330.617188 C 590.660156 331.175781 592.042969 331.457031 593.511719 331.457031 C 595.238281 331.457031 596.773438 331.15625 598.117188 330.550781 C 599.453125 329.945312 600.585938 329.132812 601.523438 328.121094 C 602.449219 327.105469 603.15625 325.9375 603.628906 324.621094 C 604.105469 323.304688 604.339844 321.90625 604.339844 320.4375 C 604.339844 318.796875 604.085938 317.296875 603.5625 315.933594 C 603.042969 314.570312 602.3125 313.398438 601.363281 312.402344 C 600.414062 311.40625 599.269531 310.644531 597.933594 310.105469 C 596.59375 309.5625 595.125 309.292969 593.523438 309.292969 C 591.925781 309.292969 590.46875 309.582031 589.152344 310.167969 C 587.835938 310.75 586.707031 311.550781 585.777344 312.566406 C 584.851562 313.582031 584.125 314.773438 583.605469 316.128906 C 583.085938 317.496094 582.828125 318.96875 582.828125 320.570312 Z M 582.816406 320.578125 " fill-opacity="1" fill-rule="nonzero"/><path fill="#43105f" d="M 618.332031 309.300781 C 619.886719 307.699219 621.738281 306.527344 623.871094 305.769531 C 626.011719 305.011719 628.179688 304.636719 630.386719 304.636719 C 634.878906 304.636719 638.121094 305.695312 640.109375 307.8125 C 642.097656 309.925781 643.09375 313.148438 643.09375 317.46875 L 643.09375 330.496094 C 643.09375 331.359375 643.132812 332.257812 643.226562 333.183594 C 643.308594 334.113281 643.421875 334.96875 643.546875 335.746094 L 638.6875 335.746094 C 638.515625 335.054688 638.417969 334.292969 638.398438 333.449219 C 638.375 332.605469 638.363281 331.859375 638.363281 331.214844 L 638.230469 331.214844 C 637.238281 332.769531 635.90625 334.046875 634.246094 335.042969 C 632.582031 336.035156 630.585938 336.53125 628.253906 336.53125 C 626.699219 336.53125 625.234375 336.339844 623.878906 335.945312 C 622.515625 335.554688 621.328125 334.984375 620.316406 334.226562 C 619.300781 333.46875 618.492188 332.53125 617.882812 331.40625 C 617.277344 330.28125 616.976562 328.988281 616.976562 327.519531 C 616.976562 325.015625 617.621094 323.046875 618.917969 321.625 C 620.214844 320.203125 621.824219 319.140625 623.746094 318.449219 C 625.671875 317.757812 627.746094 317.328125 629.972656 317.152344 C 632.199219 316.980469 634.238281 316.894531 636.097656 316.894531 L 638.039062 316.894531 L 638.039062 315.984375 C 638.039062 313.777344 637.382812 312.121094 636.066406 310.992188 C 634.746094 309.867188 632.894531 309.304688 630.523438 309.304688 C 628.886719 309.304688 627.269531 309.578125 625.695312 310.117188 C 624.117188 310.65625 622.726562 311.488281 621.515625 312.613281 L 618.339844 309.304688 Z M 632.976562 321.15625 C 629.734375 321.15625 627.164062 321.609375 625.261719 322.519531 C 623.359375 323.429688 622.410156 324.917969 622.410156 326.992188 C 622.410156 328.898438 623.046875 330.246094 624.320312 331.042969 C 625.589844 331.839844 627.179688 332.242188 629.082031 332.242188 C 630.550781 332.242188 631.835938 331.992188 632.9375 331.5 C 634.035156 331.003906 634.957031 330.34375 635.6875 329.523438 C 636.425781 328.699219 636.988281 327.738281 637.375 326.636719 C 637.765625 325.535156 637.980469 324.359375 638.019531 323.105469 L 638.019531 321.164062 L 632.96875 321.164062 Z M 632.976562 321.15625 " fill-opacity="1" fill-rule="nonzero"/><path fill="#43105f" d="M 668.949219 309.6875 L 660.003906 309.6875 L 660.003906 324.851562 C 660.003906 325.847656 660.023438 326.761719 660.066406 327.605469 C 660.109375 328.449219 660.285156 329.179688 660.589844 329.804688 C 660.890625 330.429688 661.347656 330.933594 661.953125 331.292969 C 662.558594 331.664062 663.421875 331.847656 664.546875 331.847656 C 665.277344 331.847656 666.035156 331.761719 666.8125 331.589844 C 667.589844 331.417969 668.328125 331.15625 669.019531 330.8125 L 669.210938 335.417969 C 668.347656 335.804688 667.386719 336.089844 666.324219 336.261719 C 665.265625 336.433594 664.265625 336.519531 663.308594 336.519531 C 661.496094 336.519531 660.046875 336.28125 658.96875 335.804688 C 657.886719 335.332031 657.042969 334.660156 656.4375 333.796875 C 655.832031 332.933594 655.4375 331.867188 655.238281 330.589844 C 655.046875 329.316406 654.949219 327.902344 654.949219 326.347656 L 654.949219 309.6875 L 648.335938 309.6875 L 648.335938 305.414062 L 654.949219 305.414062 L 654.949219 296.792969 L 660.003906 296.792969 L 660.003906 305.414062 L 668.945312 305.414062 L 668.945312 309.6875 Z M 668.949219 309.6875 " fill-opacity="1" fill-rule="nonzero"/><path fill="#43105f" d="M 702.257812 330.234375 C 700.445312 332.566406 698.457031 334.199219 696.296875 335.128906 C 694.136719 336.058594 691.632812 336.523438 688.78125 336.523438 C 686.402344 336.523438 684.269531 336.101562 682.367188 335.257812 C 680.460938 334.417969 678.855469 333.285156 677.535156 331.855469 C 676.21875 330.425781 675.207031 328.746094 674.492188 326.800781 C 673.78125 324.859375 673.425781 322.785156 673.425781 320.578125 C 673.425781 318.246094 673.816406 316.097656 674.59375 314.128906 C 675.371094 312.164062 676.449219 310.480469 677.832031 309.074219 C 679.214844 307.671875 680.855469 306.578125 682.761719 305.800781 C 684.664062 305.023438 686.734375 304.636719 688.984375 304.636719 C 691.101562 304.636719 693.050781 304.992188 694.820312 305.703125 C 696.59375 306.414062 698.113281 307.457031 699.394531 308.8125 C 700.664062 310.175781 701.652344 311.835938 702.34375 313.804688 C 703.035156 315.773438 703.378906 318.007812 703.378906 320.511719 L 703.378906 322.132812 L 678.878906 322.132812 C 678.964844 323.429688 679.28125 324.667969 679.824219 325.859375 C 680.363281 327.050781 681.0625 328.085938 681.929688 328.96875 C 682.792969 329.859375 683.808594 330.554688 684.972656 331.078125 C 686.140625 331.597656 687.417969 331.855469 688.792969 331.855469 C 691 331.855469 692.859375 331.464844 694.367188 330.6875 C 695.875 329.910156 697.238281 328.765625 698.449219 327.257812 L 702.269531 330.238281 Z M 697.917969 317.851562 C 697.832031 315.253906 696.988281 313.1875 695.386719 311.625 C 693.789062 310.070312 691.585938 309.292969 688.773438 309.292969 C 685.960938 309.292969 683.695312 310.070312 681.96875 311.625 C 680.246094 313.179688 679.203125 315.253906 678.859375 317.851562 Z M 697.917969 317.851562 " fill-opacity="1" fill-rule="nonzero"/><path fill="#43105f" d="M 743.738281 335.742188 L 738.742188 335.742188 L 730.121094 312.410156 L 729.988281 312.410156 L 722.34375 335.742188 L 717.15625 335.742188 L 707.304688 305.40625 L 712.875 305.40625 L 719.8125 328.738281 L 719.945312 328.738281 L 727.789062 305.40625 L 733.105469 305.40625 L 741.074219 328.738281 L 741.207031 328.738281 L 748.078125 305.40625 L 753.519531 305.40625 L 743.730469 335.742188 Z M 743.738281 335.742188 " fill-opacity="1" fill-rule="nonzero"/><path fill="#43105f" d="M 758.835938 309.300781 C 760.390625 307.699219 762.238281 306.527344 764.375 305.769531 C 766.515625 305.011719 768.683594 304.636719 770.890625 304.636719 C 775.382812 304.636719 778.621094 305.695312 780.613281 307.8125 C 782.601562 309.925781 783.59375 313.148438 783.59375 317.46875 L 783.59375 330.496094 C 783.59375 331.359375 783.636719 332.257812 783.726562 333.183594 C 783.8125 334.113281 783.917969 334.96875 784.050781 335.746094 L 779.1875 335.746094 C 779.015625 335.054688 778.917969 334.292969 778.898438 333.449219 C 778.871094 332.605469 778.867188 331.859375 778.867188 331.214844 L 778.734375 331.214844 C 777.738281 332.769531 776.410156 334.046875 774.75 335.042969 C 773.082031 336.035156 771.085938 336.53125 768.753906 336.53125 C 767.199219 336.53125 765.738281 336.339844 764.382812 335.945312 C 763.015625 335.554688 761.832031 334.984375 760.816406 334.226562 C 759.804688 333.46875 758.992188 332.53125 758.386719 331.40625 C 757.78125 330.28125 757.476562 328.988281 757.476562 327.519531 C 757.476562 325.015625 758.125 323.046875 759.421875 321.625 C 760.71875 320.203125 762.324219 319.140625 764.25 318.449219 C 766.171875 317.757812 768.246094 317.328125 770.472656 317.152344 C 772.699219 316.980469 774.742188 316.894531 776.601562 316.894531 L 778.542969 316.894531 L 778.542969 315.984375 C 778.542969 313.777344 777.882812 312.121094 776.566406 310.992188 C 775.25 309.867188 773.40625 309.304688 771.027344 309.304688 C 769.386719 309.304688 767.773438 309.578125 766.199219 310.117188 C 764.617188 310.65625 763.226562 311.488281 762.015625 312.613281 L 758.839844 309.304688 Z M 773.484375 321.15625 C 770.242188 321.15625 767.675781 321.609375 765.769531 322.519531 C 763.867188 323.429688 762.917969 324.917969 762.917969 326.992188 C 762.917969 328.898438 763.558594 330.246094 764.828125 331.042969 C 766.101562 331.839844 767.6875 332.242188 769.589844 332.242188 C 771.058594 332.242188 772.34375 331.992188 773.445312 331.5 C 774.542969 331.003906 775.46875 330.34375 776.199219 329.523438 C 776.9375 328.699219 777.496094 327.738281 777.882812 326.636719 C 778.273438 325.535156 778.492188 324.359375 778.53125 323.105469 L 778.53125 321.164062 L 773.472656 321.164062 Z M 773.484375 321.15625 " fill-opacity="1" fill-rule="nonzero"/><path fill="#43105f" d="M 804.007812 342.675781 C 803.488281 343.972656 802.960938 345.148438 802.421875 346.207031 C 801.882812 347.269531 801.234375 348.171875 800.476562 348.929688 C 799.71875 349.683594 798.8125 350.265625 797.757812 350.679688 C 796.695312 351.089844 795.414062 351.292969 793.902344 351.292969 C 793.167969 351.292969 792.402344 351.246094 791.605469 351.160156 C 790.808594 351.074219 790.058594 350.859375 789.371094 350.515625 L 790.019531 346.109375 C 790.539062 346.324219 791.078125 346.464844 791.636719 346.53125 C 792.199219 346.597656 792.851562 346.628906 793.582031 346.628906 C 795.222656 346.628906 796.433594 346.175781 797.210938 345.265625 C 797.988281 344.355469 798.660156 343.152344 799.21875 341.636719 L 801.296875 335.929688 L 788.71875 305.40625 L 794.617188 305.40625 L 804.015625 329.191406 L 804.148438 329.191406 L 813.160156 305.40625 L 818.664062 305.40625 L 804.015625 342.671875 Z M 804.007812 342.675781 " fill-opacity="1" fill-rule="nonzero"/><g fill="#43105f" fill-opacity="1"><g transform="translate(506.839658, 335.79413)"><g><path d="M 28.5625 -9.078125 L 9.28125 -9.078125 L 5.28125 0 L -0.046875 0 L 16.375 -36.296875 L 21.515625 -36.296875 L 38 0 L 32.5625 0 Z M 26.75 -13.21875 L 18.921875 -31 L 11.09375 -13.21875 Z M 26.75 -13.21875 "/></g></g></g><g fill="#43105f" fill-opacity="1"><g transform="translate(544.789245, 335.79413)"><g><path d="M 5.4375 -36.296875 L 10.625 -36.296875 L 10.625 0 L 5.4375 0 Z M 5.4375 -36.296875 "/></g></g></g></svg>
\ No newline at end of file
diff --git a/tools/docker/envoy-gateway/Dockerfile b/tools/docker/envoy-gateway/Dockerfile
index 93488f161..99352a702 100644
--- a/tools/docker/envoy-gateway/Dockerfile
+++ b/tools/docker/envoy-gateway/Dockerfile
@@ -4,7 +4,7 @@ RUN mkdir -p /var/lib/eg
 
 # Use distroless as minimal base image to package the manager binary
 # Refer to https://github.com/GoogleContainerTools/distroless for more details
-FROM gcr.io/distroless/base-nossl:nonroot@sha256:e9554da0d9569cfa21023ee8d2624d7326d80791b49b7c71b08a8b4e8d206129
+FROM gcr.io/distroless/base-nossl:nonroot@sha256:462657c8bb91f01a95cb1aabdd13d9fd2b816ac2f9fb7fe52ff07bfe50a03b38
 ARG TARGETPLATFORM
 COPY $TARGETPLATFORM/envoy-gateway /usr/local/bin/
 COPY --from=source --chown=65532:65532 /var/lib /var/lib
diff --git a/tools/make/docs.mk b/tools/make/docs.mk
index 189d203db..4ac179122 100644
--- a/tools/make/docs.mk
+++ b/tools/make/docs.mk
@@ -176,7 +176,7 @@ docs-release-gen:
 .PHONY: docs-check-links
 docs-check-links: # Check for broken links in the docs
 	@$(LOG_TARGET)
-	linkinator site/public/ -r --concurrency 25 --skip $(LINKINATOR_IGNORE)
+	linkinator site/public/ -r --concurrency 25 --skip $(LINKINATOR_IGNORE) --verbosity error
 
 docs-markdown-lint:
 	markdownlint -c .github/markdown_lint_config.json site/content/*



Test patch:
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-mixed-backendrefs.in.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-mixed-backendrefs.in.yaml
new file mode 100644
index 000000000..503a5cc14
--- /dev/null
+++ b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-mixed-backendrefs.in.yaml
@@ -0,0 +1,92 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: default
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - www.foo.com
+    parentRefs:
+    - namespace: default
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: /foo
+      backendRefs:
+      - name: service-1
+        port: 8080
+referenceGrants:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: ReferenceGrant
+  metadata:
+    namespace: envoy-gateway
+    name: referencegrant-1
+  spec:
+    from:
+    - group: gateway.envoyproxy.io
+      kind: EnvoyExtensionPolicy
+      namespace: default
+    to:
+    - group: ''
+      kind: Service
+    - group: gateway.envoyproxy.io
+      kind: Backend
+envoyExtensionPolicies:
+- apiVersion: gateway.envoyproxy.io/v1alpha1
+  kind: EnvoyExtensionPolicy
+  metadata:
+    namespace: default
+    name: policy-for-http-route
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+    extProc:
+    - backendRefs:
+      - Name: backend-ip
+        Kind: Backend
+        Group: gateway.envoyproxy.io
+      - Name: backend-fqdn
+        Namespace: envoy-gateway
+        Kind: Backend
+        Group: gateway.envoyproxy.io
+backends:
+- apiVersion: gateway.envoyproxy.io/v1alpha1
+  kind: Backend
+  metadata:
+    name: backend-ip
+    namespace: default
+  spec:
+    endpoints:
+    - ip:
+        address: 1.1.1.1
+        port: 3001
+- apiVersion: gateway.envoyproxy.io/v1alpha1
+  kind: Backend
+  metadata:
+    name: backend-fqdn
+    namespace: envoy-gateway
+  spec:
+    endpoints:
+    - fqdn:
+        hostname: example.com
+        port: 3001
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-mixed-backendrefs.out.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-mixed-backendrefs.out.yaml
new file mode 100644
index 000000000..6a9fcf156
--- /dev/null
+++ b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-mixed-backendrefs.out.yaml
@@ -0,0 +1,219 @@
+backends:
+- apiVersion: gateway.envoyproxy.io/v1alpha1
+  kind: Backend
+  metadata:
+    creationTimestamp: null
+    name: backend-ip
+    namespace: default
+  spec:
+    endpoints:
+    - ip:
+        address: 1.1.1.1
+        port: 3001
+  status:
+    conditions:
+    - lastTransitionTime: null
+      message: The Backend was accepted
+      reason: Accepted
+      status: "True"
+      type: Accepted
+- apiVersion: gateway.envoyproxy.io/v1alpha1
+  kind: Backend
+  metadata:
+    creationTimestamp: null
+    name: backend-fqdn
+    namespace: envoy-gateway
+  spec:
+    endpoints:
+    - fqdn:
+        hostname: example.com
+        port: 3001
+  status:
+    conditions:
+    - lastTransitionTime: null
+      message: The Backend was accepted
+      reason: Accepted
+      status: "True"
+      type: Accepted
+envoyExtensionPolicies:
+- apiVersion: gateway.envoyproxy.io/v1alpha1
+  kind: EnvoyExtensionPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-http-route
+    namespace: default
+  spec:
+    extProc:
+    - backendRefs:
+      - group: gateway.envoyproxy.io
+        kind: Backend
+        name: backend-ip
+      - group: gateway.envoyproxy.io
+        kind: Backend
+        name: backend-fqdn
+        namespace: envoy-gateway
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: default
+        sectionName: http
+      conditions:
+      - lastTransitionTime: null
+        message: 'ExtProc: mixed endpoints address type for the same route destination
+          is not supported.'
+        reason: Invalid
+        status: "False"
+        type: Accepted
+      controllerName: gateway.envoyproxy.io/gatewayclass-controller
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: default
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - www.foo.com
+    parentRefs:
+    - name: gateway-1
+      namespace: default
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /foo
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: gateway.envoyproxy.io/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: default
+        sectionName: http
+infraIR:
+  default/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: default/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http-80
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          gateway.envoyproxy.io/owning-gateway-name: gateway-1
+          gateway.envoyproxy.io/owning-gateway-namespace: default
+      name: default/gateway-1
+xdsIR:
+  default/gateway-1:
+    accessLog:
+      json:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      metadata:
+        kind: Gateway
+        name: gateway-1
+        namespace: default
+        sectionName: http
+      name: default/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            name: httproute/default/httproute-1/rule/0/backend/0
+            protocol: HTTP
+            weight: 1
+        directResponse:
+          statusCode: 500
+        hostname: www.foo.com
+        isHTTP2: false
+        metadata:
+          kind: HTTPRoute
+          name: httproute-1
+          namespace: default
+        name: httproute/default/httproute-1/rule/0/match/0/www_foo_com
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /foo
+    readyListener:
+      address: 0.0.0.0
+      ipFamily: IPv4
+      path: /ready
+      port: 19003
diff --git a/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-invalid-mixed-kind.in.yaml b/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-invalid-mixed-kind.in.yaml
new file mode 100644
index 000000000..569b79921
--- /dev/null
+++ b/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-invalid-mixed-kind.in.yaml
@@ -0,0 +1,49 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+backends:
+  - apiVersion: gateway.envoyproxy.io/v1alpha1
+    kind: Backend
+    metadata:
+      name: backend-fqdn
+      namespace: default
+    spec:
+      endpoints:
+        - fqdn:
+            hostname: 'primary.foo.com'
+            port: 3000
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - matches:
+            - path:
+                type: Exact
+                value: "/exact"
+          backendRefs:
+            - name: service-1
+              kind: Service
+              port: 8080
+            - name: backend-fqdn
+              kind: Backend
+              group: gateway.envoyproxy.io
+              port: 3000
diff --git a/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-invalid-mixed-kind.out.yaml b/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-invalid-mixed-kind.out.yaml
new file mode 100644
index 000000000..aca7b9e65
--- /dev/null
+++ b/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-invalid-mixed-kind.out.yaml
@@ -0,0 +1,171 @@
+backends:
+- apiVersion: gateway.envoyproxy.io/v1alpha1
+  kind: Backend
+  metadata:
+    creationTimestamp: null
+    name: backend-fqdn
+    namespace: default
+  spec:
+    endpoints:
+    - fqdn:
+        hostname: primary.foo.com
+        port: 3000
+  status:
+    conditions:
+    - lastTransitionTime: null
+      message: The Backend was accepted
+      reason: Accepted
+      status: "True"
+      type: Accepted
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - kind: Service
+        name: service-1
+        port: 8080
+      - group: gateway.envoyproxy.io
+        kind: Backend
+        name: backend-fqdn
+        port: 3000
+      matches:
+      - path:
+          type: Exact
+          value: /exact
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Mixed endpointslice address type between backendRefs is not supported
+        reason: ResolvedRefs
+        status: "False"
+        type: ResolvedRefs
+      controllerName: gateway.envoyproxy.io/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http-80
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          gateway.envoyproxy.io/owning-gateway-name: gateway-1
+          gateway.envoyproxy.io/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      json:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      metadata:
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            name: httproute/default/httproute-1/rule/0/backend/0
+            protocol: HTTP
+            weight: 1
+          - addressType: FQDN
+            endpoints:
+            - host: primary.foo.com
+              port: 3000
+            name: httproute/default/httproute-1/rule/0/backend/1
+            protocol: HTTP
+            weight: 1
+        hostname: '*'
+        isHTTP2: false
+        metadata:
+          kind: HTTPRoute
+          name: httproute-1
+          namespace: default
+        name: httproute/default/httproute-1/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          exact: /exact
+          name: ""
+    readyListener:
+      address: 0.0.0.0
+      ipFamily: IPv4
+      path: /ready
+      port: 19003
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-extauth-backend.in.yaml b/internal/gatewayapi/testdata/securitypolicy-with-extauth-backend.in.yaml
index 11715e27e..a327050f5 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-extauth-backend.in.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-extauth-backend.in.yaml
@@ -148,9 +148,6 @@ securityPolicies:
           - header2
         grpc:
           backendRefs:
-            - name: service-2
-              kind: Service
-              port: 8080
             - name: backend-fqdn
               kind: Backend
               group: gateway.envoyproxy.io
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-extauth-backend.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-extauth-backend.out.yaml
index fd2b464e2..3e48e76f8 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-extauth-backend.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-extauth-backend.out.yaml
@@ -262,9 +262,6 @@ securityPolicies:
       failOpen: true
       grpc:
         backendRefs:
-        - kind: Service
-          name: service-2
-          port: 8080
         - group: gateway.envoyproxy.io
           kind: Backend
           name: backend-fqdn
@@ -405,22 +402,15 @@ xdsIR:
           extAuth:
             failOpen: true
             grpc:
-              authority: service-2.default:8080
+              authority: primary.foo.com:3000
               destination:
                 name: securitypolicy/default/policy-for-http-route-1/extauth/0
                 settings:
-                - addressType: IP
-                  endpoints:
-                  - host: 7.7.7.7
-                    port: 8080
-                  name: securitypolicy/default/policy-for-http-route-1/extauth/0/backend/0
-                  protocol: GRPC
-                  weight: 1
                 - addressType: FQDN
                   endpoints:
                   - host: primary.foo.com
                     port: 3000
-                  name: securitypolicy/default/policy-for-http-route-1/extauth/0/backend/1
+                  name: securitypolicy/default/policy-for-http-route-1/extauth/0/backend/0
                   protocol: GRPC
                   weight: 1
             headersToExtAuth:
@@ -452,22 +442,15 @@ xdsIR:
           extAuth:
             failOpen: true
             grpc:
-              authority: service-2.default:8080
+              authority: primary.foo.com:3000
               destination:
                 name: securitypolicy/default/policy-for-http-route-1/extauth/0
                 settings:
-                - addressType: IP
-                  endpoints:
-                  - host: 7.7.7.7
-                    port: 8080
-                  name: securitypolicy/default/policy-for-http-route-1/extauth/0/backend/0
-                  protocol: GRPC
-                  weight: 1
                 - addressType: FQDN
                   endpoints:
                   - host: primary.foo.com
                     port: 3000
-                  name: securitypolicy/default/policy-for-http-route-1/extauth/0/backend/1
+                  name: securitypolicy/default/policy-for-http-route-1/extauth/0/backend/0
                   protocol: GRPC
                   weight: 1
             headersToExtAuth:
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-extauth-body.in.yaml b/internal/gatewayapi/testdata/securitypolicy-with-extauth-body.in.yaml
index d45b50c88..22ec1502d 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-extauth-body.in.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-extauth-body.in.yaml
@@ -103,9 +103,6 @@ securityPolicies:
           maxRequestBytes: 32768
         grpc:
           backendRefs:
-            - name: service-2
-              kind: Service
-              port: 8080
             - name: backend-fqdn
               kind: Backend
               group: gateway.envoyproxy.io
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-extauth-body.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-extauth-body.out.yaml
index 411278ef9..a9777f7a8 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-extauth-body.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-extauth-body.out.yaml
@@ -171,9 +171,6 @@ securityPolicies:
       failOpen: true
       grpc:
         backendRefs:
-        - kind: Service
-          name: service-2
-          port: 8080
         - group: gateway.envoyproxy.io
           kind: Backend
           name: backend-fqdn
@@ -248,22 +245,15 @@ xdsIR:
               maxRequestBytes: 32768
             failOpen: true
             grpc:
-              authority: service-2.default:8080
+              authority: primary.foo.com:3000
               destination:
                 name: securitypolicy/default/policy-for-http-route-1/extauth/0
                 settings:
-                - addressType: IP
-                  endpoints:
-                  - host: 7.7.7.7
-                    port: 8080
-                  name: securitypolicy/default/policy-for-http-route-1/extauth/0/backend/0
-                  protocol: GRPC
-                  weight: 1
                 - addressType: FQDN
                   endpoints:
                   - host: primary.foo.com
                     port: 3000
-                  name: securitypolicy/default/policy-for-http-route-1/extauth/0/backend/1
+                  name: securitypolicy/default/policy-for-http-route-1/extauth/0/backend/0
                   protocol: GRPC
                   weight: 1
             headersToExtAuth:
@@ -297,22 +287,15 @@ xdsIR:
               maxRequestBytes: 32768
             failOpen: true
             grpc:
-              authority: service-2.default:8080
+              authority: primary.foo.com:3000
               destination:
                 name: securitypolicy/default/policy-for-http-route-1/extauth/0
                 settings:
-                - addressType: IP
-                  endpoints:
-                  - host: 7.7.7.7
-                    port: 8080
-                  name: securitypolicy/default/policy-for-http-route-1/extauth/0/backend/0
-                  protocol: GRPC
-                  weight: 1
                 - addressType: FQDN
                   endpoints:
                   - host: primary.foo.com
                     port: 3000
-                  name: securitypolicy/default/policy-for-http-route-1/extauth/0/backend/1
+                  name: securitypolicy/default/policy-for-http-route-1/extauth/0/backend/0
                   protocol: GRPC
                   weight: 1
             headersToExtAuth:
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-extauth-recomputation.in.yaml b/internal/gatewayapi/testdata/securitypolicy-with-extauth-recomputation.in.yaml
index 5cab33ed6..adc601d21 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-extauth-recomputation.in.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-extauth-recomputation.in.yaml
@@ -102,9 +102,6 @@ securityPolicies:
           - header2
         grpc:
           backendRefs:
-            - name: service-2
-              kind: Service
-              port: 8080
             - name: backend-fqdn
               kind: Backend
               group: gateway.envoyproxy.io
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-extauth-recomputation.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-extauth-recomputation.out.yaml
index 574b8f155..0e5423132 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-extauth-recomputation.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-extauth-recomputation.out.yaml
@@ -169,9 +169,6 @@ securityPolicies:
       failOpen: true
       grpc:
         backendRefs:
-        - kind: Service
-          name: service-2
-          port: 8080
         - group: gateway.envoyproxy.io
           kind: Backend
           name: backend-fqdn
@@ -245,22 +242,15 @@ xdsIR:
           extAuth:
             failOpen: true
             grpc:
-              authority: service-2.default:8080
+              authority: primary.foo.com:3000
               destination:
                 name: securitypolicy/default/policy-for-http-route-1/extauth/0
                 settings:
-                - addressType: IP
-                  endpoints:
-                  - host: 7.7.7.7
-                    port: 8080
-                  name: securitypolicy/default/policy-for-http-route-1/extauth/0/backend/0
-                  protocol: GRPC
-                  weight: 1
                 - addressType: FQDN
                   endpoints:
                   - host: primary.foo.com
                     port: 3000
-                  name: securitypolicy/default/policy-for-http-route-1/extauth/0/backend/1
+                  name: securitypolicy/default/policy-for-http-route-1/extauth/0/backend/0
                   protocol: GRPC
                   weight: 1
             headersToExtAuth:
@@ -293,22 +283,15 @@ xdsIR:
           extAuth:
             failOpen: true
             grpc:
-              authority: service-2.default:8080
+              authority: primary.foo.com:3000
               destination:
                 name: securitypolicy/default/policy-for-http-route-1/extauth/0
                 settings:
-                - addressType: IP
-                  endpoints:
-                  - host: 7.7.7.7
-                    port: 8080
-                  name: securitypolicy/default/policy-for-http-route-1/extauth/0/backend/0
-                  protocol: GRPC
-                  weight: 1
                 - addressType: FQDN
                   endpoints:
                   - host: primary.foo.com
                     port: 3000
-                  name: securitypolicy/default/policy-for-http-route-1/extauth/0/backend/1
+                  name: securitypolicy/default/policy-for-http-route-1/extauth/0/backend/0
                   protocol: GRPC
                   weight: 1
             headersToExtAuth:
diff --git a/internal/ir/xds_test.go b/internal/ir/xds_test.go
index cfbd84c91..c1af9ce19 100644
--- a/internal/ir/xds_test.go
+++ b/internal/ir/xds_test.go
@@ -1172,6 +1172,53 @@ func TestValidateRouteDestination(t *testing.T) {
 			},
 			want: ErrDestinationNameEmpty,
 		},
+		{
+			name: "mixed address types with MIXED in destinations",
+			input: RouteDestination{
+				Settings: []*DestinationSetting{
+					{
+						Endpoints: []*DestinationEndpoint{
+							{
+								Host: "10.11.12.13",
+								Port: 8080,
+							},
+							{
+								Host: "example.com",
+								Port: 8080,
+							},
+						},
+						AddressType: ptr.To(MIXED),
+					},
+				},
+			},
+			want: ErrRouteDestinationsFQDNMixed,
+		},
+		{
+			name: "mixed address types with FQDN in destinations",
+			input: RouteDestination{
+				Settings: []*DestinationSetting{
+					{
+						Endpoints: []*DestinationEndpoint{
+							{
+								Host: "10.11.12.13",
+								Port: 8080,
+							},
+						},
+						AddressType: ptr.To(IP),
+					},
+					{
+						Endpoints: []*DestinationEndpoint{
+							{
+								Host: "example.com",
+								Port: 8080,
+							},
+						},
+						AddressType: ptr.To(FQDN),
+					},
+				},
+			},
+			want: ErrRouteDestinationsFQDNMixed,
+		},
 	}
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {