Repository: envoyproxy/gateway
Pull request #6157 (2025-05-22 10:19:20)

local_ratelimit: make sure x-ratelimit-reset exists
fixes: https://github.com/envoyproxy/gateway/issues/5693

xref: https://github.com/envoyproxy/envoy/pull/39501 https://github.com/envoyproxy/gateway/pull/6059

codecov[bot]: ## [Codecov](https://app.codecov.io/gh/envoyproxy/gateway/pull/6157?dropdown=coverage&src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=envoyproxy) Report
All modified and coverable lines are covered by tests :white_check_mark:
> Project coverage is 70.56%. Comparing base [(`c09c42c`)](https://app.codecov.io/gh/envoyproxy/gateway/commit/c09c42ca34a2eba9d7699e800c218c293f69d5fc?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=envoyproxy) to head [(`b41eb8f`)](https://app.codecov.io/gh/envoyproxy/gateway/commit/b41eb8fe559cfb0b157d7fb4fa2905c338afa039?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=envoyproxy).

<details><summary>Additional details and impacted files</summary>


```diff
@@            Coverage Diff             @@
##             main    #6157      +/-   ##
==========================================
+ Coverage   70.53%   70.56%   +0.03%     
==========================================
  Files         219      219              
  Lines       36345    36345              
==========================================
+ Hits        25635    25646      +11     
+ Misses       9188     9180       -8     
+ Partials     1522     1519       -3     
```

</details>

[:umbrella: View full report in Codecov by Sentry](https://app.codecov.io/gh/envoyproxy/gateway/pull/6157?dropdown=coverage&src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=envoyproxy).   
:loudspeaker: Have feedback on the report? [Share it here](https://about.codecov.io/codecov-pr-comment-feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=envoyproxy).

<details><summary> :rocket: New features to boost your workflow: </summary>

- :snowflake: [Test Analytics](https://docs.codecov.com/docs/test-analytics): Detect flaky tests, report on failures, and find test suite problems.
</details>

Patch:
diff --git a/.gitignore b/.gitignore
index e7be6a4f7..5a0ce8cb1 100644
--- a/.gitignore
+++ b/.gitignore
@@ -44,3 +44,5 @@ charts/gateway-addons-helm/dashboards/vendor/
 *.tar.gz
 
 *.yaml-e
+
+*.out
diff --git a/api/v1alpha1/envoyproxy_helpers.go b/api/v1alpha1/envoyproxy_helpers.go
index ec69147e6..b141f179c 100644
--- a/api/v1alpha1/envoyproxy_helpers.go
+++ b/api/v1alpha1/envoyproxy_helpers.go
@@ -143,6 +143,11 @@ func (logging *ProxyLogging) GetEnvoyProxyComponentLevel() string {
 		}
 	}
 
+	if len(args) == 0 {
+		// use "misc:error" as default
+		args = []string{"misc:error"}
+	}
+
 	sort.Strings(args)
 
 	return strings.Join(args, ",")
diff --git a/api/v1alpha1/healthcheck_types.go b/api/v1alpha1/healthcheck_types.go
index 0cfb16630..6a21b5264 100644
--- a/api/v1alpha1/healthcheck_types.go
+++ b/api/v1alpha1/healthcheck_types.go
@@ -149,6 +149,13 @@ const (
 
 // HTTPActiveHealthChecker defines the settings of http health check.
 type HTTPActiveHealthChecker struct {
+	// Hostname defines the HTTP host that will be requested during health checking.
+	// Default: HTTPRoute or GRPCRoute hostname.
+	//
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=253
+	// +kubebuilder:validation:Pattern=`^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$`
+	Hostname *string `json:"hostname,omitempty" yaml:"hostname,omitempty"`
 	// Path defines the HTTP path that will be requested during health checking.
 	// +kubebuilder:validation:MinLength=1
 	// +kubebuilder:validation:MaxLength=1024
diff --git a/api/v1alpha1/zz_generated.deepcopy.go b/api/v1alpha1/zz_generated.deepcopy.go
index 524264cd6..9039df88c 100644
--- a/api/v1alpha1/zz_generated.deepcopy.go
+++ b/api/v1alpha1/zz_generated.deepcopy.go
@@ -3003,6 +3003,11 @@ func (in *HTTP3Settings) DeepCopy() *HTTP3Settings {
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *HTTPActiveHealthChecker) DeepCopyInto(out *HTTPActiveHealthChecker) {
 	*out = *in
+	if in.Hostname != nil {
+		in, out := &in.Hostname, &out.Hostname
+		*out = new(string)
+		**out = **in
+	}
 	if in.Method != nil {
 		in, out := &in.Method, &out.Method
 		*out = new(string)
diff --git a/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_backendtrafficpolicies.yaml b/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_backendtrafficpolicies.yaml
index 4aeb42b0a..d6e3a6bc9 100644
--- a/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_backendtrafficpolicies.yaml
+++ b/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_backendtrafficpolicies.yaml
@@ -323,6 +323,14 @@ spec:
                               minimum: 100
                               type: integer
                             type: array
+                          hostname:
+                            description: |-
+                              Hostname defines the HTTP host that will be requested during health checking.
+                              Default: HTTPRoute or GRPCRoute hostname.
+                            maxLength: 253
+                            minLength: 1
+                            pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                            type: string
                           method:
                             description: |-
                               Method defines the HTTP method used for health checking.
diff --git a/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_envoyextensionpolicies.yaml b/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_envoyextensionpolicies.yaml
index 7e8fa5d33..76f7fc509 100644
--- a/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_envoyextensionpolicies.yaml
+++ b/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_envoyextensionpolicies.yaml
@@ -421,6 +421,14 @@ spec:
                                         minimum: 100
                                         type: integer
                                       type: array
+                                    hostname:
+                                      description: |-
+                                        Hostname defines the HTTP host that will be requested during health checking.
+                                        Default: HTTPRoute or GRPCRoute hostname.
+                                      maxLength: 253
+                                      minLength: 1
+                                      pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                      type: string
                                     method:
                                       description: |-
                                         Method defines the HTTP method used for health checking.
diff --git a/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_envoyproxies.yaml b/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_envoyproxies.yaml
index 8ec65f47c..9dee1628e 100644
--- a/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_envoyproxies.yaml
+++ b/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_envoyproxies.yaml
@@ -10915,6 +10915,14 @@ spec:
                                                           minimum: 100
                                                           type: integer
                                                         type: array
+                                                      hostname:
+                                                        description: |-
+                                                          Hostname defines the HTTP host that will be requested during health checking.
+                                                          Default: HTTPRoute or GRPCRoute hostname.
+                                                        maxLength: 253
+                                                        minLength: 1
+                                                        pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                                        type: string
                                                       method:
                                                         description: |-
                                                           Method defines the HTTP method used for health checking.
@@ -11934,6 +11942,14 @@ spec:
                                                           minimum: 100
                                                           type: integer
                                                         type: array
+                                                      hostname:
+                                                        description: |-
+                                                          Hostname defines the HTTP host that will be requested during health checking.
+                                                          Default: HTTPRoute or GRPCRoute hostname.
+                                                        maxLength: 253
+                                                        minLength: 1
+                                                        pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                                        type: string
                                                       method:
                                                         description: |-
                                                           Method defines the HTTP method used for health checking.
@@ -13042,6 +13058,14 @@ spec:
                                                     minimum: 100
                                                     type: integer
                                                   type: array
+                                                hostname:
+                                                  description: |-
+                                                    Hostname defines the HTTP host that will be requested during health checking.
+                                                    Default: HTTPRoute or GRPCRoute hostname.
+                                                  maxLength: 253
+                                                  minLength: 1
+                                                  pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                                  type: string
                                                 method:
                                                   description: |-
                                                     Method defines the HTTP method used for health checking.
@@ -14067,6 +14091,14 @@ spec:
                                               minimum: 100
                                               type: integer
                                             type: array
+                                          hostname:
+                                            description: |-
+                                              Hostname defines the HTTP host that will be requested during health checking.
+                                              Default: HTTPRoute or GRPCRoute hostname.
+                                            maxLength: 253
+                                            minLength: 1
+                                            pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                            type: string
                                           method:
                                             description: |-
                                               Method defines the HTTP method used for health checking.
diff --git a/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_securitypolicies.yaml b/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_securitypolicies.yaml
index 016098806..6b63d560a 100644
--- a/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_securitypolicies.yaml
+++ b/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_securitypolicies.yaml
@@ -914,6 +914,14 @@ spec:
                                           minimum: 100
                                           type: integer
                                         type: array
+                                      hostname:
+                                        description: |-
+                                          Hostname defines the HTTP host that will be requested during health checking.
+                                          Default: HTTPRoute or GRPCRoute hostname.
+                                        maxLength: 253
+                                        minLength: 1
+                                        pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                        type: string
                                       method:
                                         description: |-
                                           Method defines the HTTP method used for health checking.
@@ -1831,6 +1839,14 @@ spec:
                                           minimum: 100
                                           type: integer
                                         type: array
+                                      hostname:
+                                        description: |-
+                                          Hostname defines the HTTP host that will be requested during health checking.
+                                          Default: HTTPRoute or GRPCRoute hostname.
+                                        maxLength: 253
+                                        minLength: 1
+                                        pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                        type: string
                                       method:
                                         description: |-
                                           Method defines the HTTP method used for health checking.
@@ -2943,6 +2959,14 @@ spec:
                                                 minimum: 100
                                                 type: integer
                                               type: array
+                                            hostname:
+                                              description: |-
+                                                Hostname defines the HTTP host that will be requested during health checking.
+                                                Default: HTTPRoute or GRPCRoute hostname.
+                                              maxLength: 253
+                                              minLength: 1
+                                              pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                              type: string
                                             method:
                                               description: |-
                                                 Method defines the HTTP method used for health checking.
@@ -4050,6 +4074,14 @@ spec:
                                           minimum: 100
                                           type: integer
                                         type: array
+                                      hostname:
+                                        description: |-
+                                          Hostname defines the HTTP host that will be requested during health checking.
+                                          Default: HTTPRoute or GRPCRoute hostname.
+                                        maxLength: 253
+                                        minLength: 1
+                                        pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                        type: string
                                       method:
                                         description: |-
                                           Method defines the HTTP method used for health checking.
diff --git a/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_backendtrafficpolicies.yaml b/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_backendtrafficpolicies.yaml
index 2f79f196d..2d54b9a6c 100644
--- a/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_backendtrafficpolicies.yaml
+++ b/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_backendtrafficpolicies.yaml
@@ -322,6 +322,14 @@ spec:
                               minimum: 100
                               type: integer
                             type: array
+                          hostname:
+                            description: |-
+                              Hostname defines the HTTP host that will be requested during health checking.
+                              Default: HTTPRoute or GRPCRoute hostname.
+                            maxLength: 253
+                            minLength: 1
+                            pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                            type: string
                           method:
                             description: |-
                               Method defines the HTTP method used for health checking.
diff --git a/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_envoyextensionpolicies.yaml b/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_envoyextensionpolicies.yaml
index d49a6046d..82e63b062 100644
--- a/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_envoyextensionpolicies.yaml
+++ b/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_envoyextensionpolicies.yaml
@@ -420,6 +420,14 @@ spec:
                                         minimum: 100
                                         type: integer
                                       type: array
+                                    hostname:
+                                      description: |-
+                                        Hostname defines the HTTP host that will be requested during health checking.
+                                        Default: HTTPRoute or GRPCRoute hostname.
+                                      maxLength: 253
+                                      minLength: 1
+                                      pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                      type: string
                                     method:
                                       description: |-
                                         Method defines the HTTP method used for health checking.
diff --git a/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_envoyproxies.yaml b/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_envoyproxies.yaml
index 0a5d48d5b..f588500c9 100644
--- a/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_envoyproxies.yaml
+++ b/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_envoyproxies.yaml
@@ -10914,6 +10914,14 @@ spec:
                                                           minimum: 100
                                                           type: integer
                                                         type: array
+                                                      hostname:
+                                                        description: |-
+                                                          Hostname defines the HTTP host that will be requested during health checking.
+                                                          Default: HTTPRoute or GRPCRoute hostname.
+                                                        maxLength: 253
+                                                        minLength: 1
+                                                        pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                                        type: string
                                                       method:
                                                         description: |-
                                                           Method defines the HTTP method used for health checking.
@@ -11933,6 +11941,14 @@ spec:
                                                           minimum: 100
                                                           type: integer
                                                         type: array
+                                                      hostname:
+                                                        description: |-
+                                                          Hostname defines the HTTP host that will be requested during health checking.
+                                                          Default: HTTPRoute or GRPCRoute hostname.
+                                                        maxLength: 253
+                                                        minLength: 1
+                                                        pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                                        type: string
                                                       method:
                                                         description: |-
                                                           Method defines the HTTP method used for health checking.
@@ -13041,6 +13057,14 @@ spec:
                                                     minimum: 100
                                                     type: integer
                                                   type: array
+                                                hostname:
+                                                  description: |-
+                                                    Hostname defines the HTTP host that will be requested during health checking.
+                                                    Default: HTTPRoute or GRPCRoute hostname.
+                                                  maxLength: 253
+                                                  minLength: 1
+                                                  pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                                  type: string
                                                 method:
                                                   description: |-
                                                     Method defines the HTTP method used for health checking.
@@ -14066,6 +14090,14 @@ spec:
                                               minimum: 100
                                               type: integer
                                             type: array
+                                          hostname:
+                                            description: |-
+                                              Hostname defines the HTTP host that will be requested during health checking.
+                                              Default: HTTPRoute or GRPCRoute hostname.
+                                            maxLength: 253
+                                            minLength: 1
+                                            pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                            type: string
                                           method:
                                             description: |-
                                               Method defines the HTTP method used for health checking.
diff --git a/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_securitypolicies.yaml b/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_securitypolicies.yaml
index a7be8cd8d..104b417cd 100644
--- a/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_securitypolicies.yaml
+++ b/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_securitypolicies.yaml
@@ -913,6 +913,14 @@ spec:
                                           minimum: 100
                                           type: integer
                                         type: array
+                                      hostname:
+                                        description: |-
+                                          Hostname defines the HTTP host that will be requested during health checking.
+                                          Default: HTTPRoute or GRPCRoute hostname.
+                                        maxLength: 253
+                                        minLength: 1
+                                        pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                        type: string
                                       method:
                                         description: |-
                                           Method defines the HTTP method used for health checking.
@@ -1830,6 +1838,14 @@ spec:
                                           minimum: 100
                                           type: integer
                                         type: array
+                                      hostname:
+                                        description: |-
+                                          Hostname defines the HTTP host that will be requested during health checking.
+                                          Default: HTTPRoute or GRPCRoute hostname.
+                                        maxLength: 253
+                                        minLength: 1
+                                        pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                        type: string
                                       method:
                                         description: |-
                                           Method defines the HTTP method used for health checking.
@@ -2942,6 +2958,14 @@ spec:
                                                 minimum: 100
                                                 type: integer
                                               type: array
+                                            hostname:
+                                              description: |-
+                                                Hostname defines the HTTP host that will be requested during health checking.
+                                                Default: HTTPRoute or GRPCRoute hostname.
+                                              maxLength: 253
+                                              minLength: 1
+                                              pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                              type: string
                                             method:
                                               description: |-
                                                 Method defines the HTTP method used for health checking.
@@ -4049,6 +4073,14 @@ spec:
                                           minimum: 100
                                           type: integer
                                         type: array
+                                      hostname:
+                                        description: |-
+                                          Hostname defines the HTTP host that will be requested during health checking.
+                                          Default: HTTPRoute or GRPCRoute hostname.
+                                        maxLength: 253
+                                        minLength: 1
+                                        pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                        type: string
                                       method:
                                         description: |-
                                           Method defines the HTTP method used for health checking.
diff --git a/internal/gatewayapi/clustersettings.go b/internal/gatewayapi/clustersettings.go
index 01b543ae9..0700a64b2 100644
--- a/internal/gatewayapi/clustersettings.go
+++ b/internal/gatewayapi/clustersettings.go
@@ -429,6 +429,9 @@ func buildHTTPActiveHealthChecker(h *egv1a1.HTTPActiveHealthChecker) *ir.HTTPHea
 	if irHTTP.Method != nil {
 		*irHTTP.Method = strings.ToUpper(*irHTTP.Method)
 	}
+	if h.Hostname != nil {
+		irHTTP.Host = *h.Hostname
+	}
 
 	// deduplicate http statuses
 	statusSet := sets.NewInt()
diff --git a/internal/infrastructure/common/proxy_args.go b/internal/infrastructure/common/proxy_args.go
index 78544b636..98a7e22cd 100644
--- a/internal/infrastructure/common/proxy_args.go
+++ b/internal/infrastructure/common/proxy_args.go
@@ -72,9 +72,6 @@ func BuildProxyArgs(
 
 	if componentsLogLevel := logging.GetEnvoyProxyComponentLevel(); componentsLogLevel != "" {
 		args = append(args, fmt.Sprintf("--component-log-level %s", componentsLogLevel))
-	} else {
-		// Default to error level for misc components if not set.
-		args = append(args, fmt.Sprintf("--component-log-level %s", "misc:error"))
 	}
 
 	// Default drain timeout.
diff --git a/internal/provider/kubernetes/topology_injector.go b/internal/provider/kubernetes/topology_injector.go
index b0569e5aa..9a4edea22 100644
--- a/internal/provider/kubernetes/topology_injector.go
+++ b/internal/provider/kubernetes/topology_injector.go
@@ -80,7 +80,7 @@ func (m *ProxyTopologyInjector) Handle(ctx context.Context, req admission.Reques
 		if binding.Annotations == nil {
 			binding.Annotations = map[string]string{}
 		}
-		binding.Annotations[corev1.LabelTopologyZone] = zone
+		binding.Annotations[corev1.LabelTopologyZone] = fmt.Sprintf("%q", zone)
 	} else {
 		logger.V(1).Info("Skipping injection due to missing topology label on node")
 		return admission.Allowed("Skipping injection due to missing topology label on node")
diff --git a/internal/xds/bootstrap/bootstrap.yaml.tpl b/internal/xds/bootstrap/bootstrap.yaml.tpl
index dafb277d9..c6956fe86 100644
--- a/internal/xds/bootstrap/bootstrap.yaml.tpl
+++ b/internal/xds/bootstrap/bootstrap.yaml.tpl
@@ -12,7 +12,7 @@ cluster_manager:
   local_cluster_name: local_cluster
 node:
   locality:
-    zone: "$(ENVOY_SERVICE_ZONE)"
+    zone: $(ENVOY_SERVICE_ZONE)
 {{- if .StatsMatcher  }}
 stats_config:
   stats_matcher:
@@ -186,7 +186,7 @@ static_resources:
           load_balancing_weight: 1
         load_balancing_weight: 1
         locality:
-          zone: "$(ENVOY_SERVICE_ZONE)"
+          zone: $(ENVOY_SERVICE_ZONE)
     name: local_cluster
     type: STATIC
   - connect_timeout: 10s
diff --git a/release-notes/current.yaml b/release-notes/current.yaml
index 1f4474042..decd1f725 100644
--- a/release-notes/current.yaml
+++ b/release-notes/current.yaml
@@ -15,8 +15,10 @@ new features: |
   Added support for local rate limit header.
   Added XDS metadata for clusters and endpoints from xRoutes and referenced backend resources (Backend, Service, ServiceImport).
   Added support for setting ownerreference to infra resources when enable gateway namespace mode.
+  Added support for configuring hostname in active HTTP healthchecks.
 
 bug fixes: |
+  Handle integer zone annotation values
   Fixed issue where WASM cache init failure caused routes with WASM-less EnvoyExtensionPolicies to have 500 direct responses.
 
 # Enhancements that improve performance.
diff --git a/tools/hack/create-cluster.sh b/tools/hack/create-cluster.sh
index 6c2a93f51..6b440b084 100755
--- a/tools/hack/create-cluster.sh
+++ b/tools/hack/create-cluster.sh
@@ -30,14 +30,14 @@ networking:
 nodes:
 - role: control-plane
   labels:
-    "topology.kubernetes.io/zone": "0"
+    "topology.kubernetes.io/zone": 0
 EOM
 )
 
 # https://kind.sigs.k8s.io/docs/user/quick-start/#multi-node-clusters
 if [[ -n "${NUM_WORKERS}" ]]; then
 for i in $(seq 1 "${NUM_WORKERS}"); do
-  KIND_CFG+=$(printf "\n- role: worker\n  labels:\n    \"topology.kubernetes.io/zone\": \"%s\"" "$i")
+  KIND_CFG+=$(printf "\n- role: worker\n  labels:\n    \"topology.kubernetes.io/zone\": %s" "$i")
 done
 fi
 
diff --git a/tools/make/kube.mk b/tools/make/kube.mk
index 2ecf50f6f..d9ba80845 100644
--- a/tools/make/kube.mk
+++ b/tools/make/kube.mk
@@ -28,6 +28,8 @@ BENCHMARK_REPORT_DIR ?= benchmark_report
 E2E_RUN_TEST ?=
 E2E_CLEANUP ?= true
 E2E_TIMEOUT ?= 20m
+# E2E_REDIRECT allow you specified a redirect when run e2e test locally, e.g. `>> test_output.out 2>&1`
+E2E_REDIRECT ?=
 E2E_TEST_ARGS ?= -v -tags e2e -timeout $(E2E_TIMEOUT)
 
 KUBE_DEPLOY_PROFILE ?= default
@@ -215,13 +217,13 @@ e2e-prepare: prepare-ip-family ## Prepare the environment for running e2e tests
 run-e2e: ## Run e2e tests
 	@$(LOG_TARGET)
 ifeq ($(E2E_RUN_TEST),)
-	go test $(E2E_TEST_ARGS) ./test/e2e --gateway-class=envoy-gateway --debug=true --cleanup-base-resources=false
+	go test $(E2E_TEST_ARGS) ./test/e2e --gateway-class=envoy-gateway --debug=true --cleanup-base-resources=false $(E2E_REDIRECT)
 	go test $(E2E_TEST_ARGS) ./test/e2e/merge_gateways --gateway-class=merge-gateways --debug=true --cleanup-base-resources=false
 	go test $(E2E_TEST_ARGS) ./test/e2e/multiple_gc --debug=true --cleanup-base-resources=true
 	LAST_VERSION_TAG=$(shell cat VERSION) go test $(E2E_TEST_ARGS) ./test/e2e/upgrade --gateway-class=upgrade --debug=true --cleanup-base-resources=$(E2E_CLEANUP)
 else
 	go test $(E2E_TEST_ARGS) ./test/e2e --gateway-class=envoy-gateway --debug=true --cleanup-base-resources=$(E2E_CLEANUP) \
-		--run-test $(E2E_RUN_TEST)
+		--run-test $(E2E_RUN_TEST) $(E2E_REDIRECT)
 endif
 
 run-e2e-upgrade:


Test patch:
diff --git a/api/v1alpha1/validation/envoyproxy_validate_test.go b/api/v1alpha1/validation/envoyproxy_validate_test.go
index 9c96792f5..f6ff1c6b2 100644
--- a/api/v1alpha1/validation/envoyproxy_validate_test.go
+++ b/api/v1alpha1/validation/envoyproxy_validate_test.go
@@ -847,7 +847,7 @@ func TestGetEnvoyProxyComponentLevelArgs(t *testing.T) {
 	}{
 		{
 			logging:  egv1a1.ProxyLogging{},
-			expected: "",
+			expected: "misc:error",
 		},
 		{
 			logging: egv1a1.ProxyLogging{
@@ -855,7 +855,7 @@ func TestGetEnvoyProxyComponentLevelArgs(t *testing.T) {
 					egv1a1.LogComponentDefault: egv1a1.LogLevelInfo,
 				},
 			},
-			expected: "",
+			expected: "misc:error",
 		},
 		{
 			logging: egv1a1.ProxyLogging{
diff --git a/internal/cmd/egctl/testdata/translate/out/default-resources.all.yaml b/internal/cmd/egctl/testdata/translate/out/default-resources.all.yaml
index d32896c2c..cefeca7d5 100644
--- a/internal/cmd/egctl/testdata/translate/out/default-resources.all.yaml
+++ b/internal/cmd/egctl/testdata/translate/out/default-resources.all.yaml
@@ -23,7 +23,7 @@ envoyProxyForGatewayClass:
           local_cluster_name: local_cluster
         node:
           locality:
-            zone: "$(ENVOY_SERVICE_ZONE)"
+            zone: $(ENVOY_SERVICE_ZONE)
         layered_runtime:
           layers:
           - name: global_config
@@ -108,7 +108,7 @@ envoyProxyForGatewayClass:
                   load_balancing_weight: 1
                 load_balancing_weight: 1
                 locality:
-                  zone: "$(ENVOY_SERVICE_ZONE)"
+                  zone: $(ENVOY_SERVICE_ZONE)
             name: local_cluster
             type: STATIC
           - connect_timeout: 10s
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-healthcheck.in.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-healthcheck.in.yaml
index fc324a70a..e2c0a82d9 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-healthcheck.in.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-healthcheck.in.yaml
@@ -200,6 +200,7 @@ backendTrafficPolicies:
         healthyThreshold: 3
         type: HTTP
         http:
+          hostname: foo.bar
           path: "/healthz"
           method: "GET"
           expectedStatuses:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-healthcheck.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-healthcheck.out.yaml
index a92313579..643d5d8fc 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-healthcheck.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-healthcheck.out.yaml
@@ -16,6 +16,7 @@ backendTrafficPolicies:
           expectedStatuses:
           - 200
           - 201
+          hostname: foo.bar
           method: GET
           path: /healthz
         interval: 5s
@@ -1017,7 +1018,7 @@ xdsIR:
                 expectedStatuses:
                 - 200
                 - 201
-                host: gateway.envoyproxy.io
+                host: foo.bar
                 method: GET
                 path: /healthz
               interval: 5s
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/custom.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/custom.yaml
index 490b8516f..4603f7247 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/custom.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/custom.yaml
@@ -52,7 +52,7 @@ spec:
             local_cluster_name: local_cluster
           node:
             locality:
-              zone: "$(ENVOY_SERVICE_ZONE)"
+              zone: $(ENVOY_SERVICE_ZONE)
           layered_runtime:
             layers:
             - name: global_config
@@ -137,7 +137,7 @@ spec:
                     load_balancing_weight: 1
                   load_balancing_weight: 1
                   locality:
-                    zone: "$(ENVOY_SERVICE_ZONE)"
+                    zone: $(ENVOY_SERVICE_ZONE)
               name: local_cluster
               type: STATIC
             - connect_timeout: 10s
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/default-env.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/default-env.yaml
index f2a9ac4af..a1a4d9bf9 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/default-env.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/default-env.yaml
@@ -51,7 +51,7 @@ spec:
             local_cluster_name: local_cluster
           node:
             locality:
-              zone: "$(ENVOY_SERVICE_ZONE)"
+              zone: $(ENVOY_SERVICE_ZONE)
           layered_runtime:
             layers:
             - name: global_config
@@ -136,7 +136,7 @@ spec:
                     load_balancing_weight: 1
                   load_balancing_weight: 1
                   locality:
-                    zone: "$(ENVOY_SERVICE_ZONE)"
+                    zone: $(ENVOY_SERVICE_ZONE)
               name: local_cluster
               type: STATIC
             - connect_timeout: 10s
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/default.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/default.yaml
index e76912906..b4e83c6d4 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/default.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/default.yaml
@@ -51,7 +51,7 @@ spec:
             local_cluster_name: local_cluster
           node:
             locality:
-              zone: "$(ENVOY_SERVICE_ZONE)"
+              zone: $(ENVOY_SERVICE_ZONE)
           layered_runtime:
             layers:
             - name: global_config
@@ -136,7 +136,7 @@ spec:
                     load_balancing_weight: 1
                   load_balancing_weight: 1
                   locality:
-                    zone: "$(ENVOY_SERVICE_ZONE)"
+                    zone: $(ENVOY_SERVICE_ZONE)
               name: local_cluster
               type: STATIC
             - connect_timeout: 10s
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/disable-prometheus.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/disable-prometheus.yaml
index 9d28c2438..aec6f5336 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/disable-prometheus.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/disable-prometheus.yaml
@@ -47,7 +47,7 @@ spec:
             local_cluster_name: local_cluster
           node:
             locality:
-              zone: "$(ENVOY_SERVICE_ZONE)"
+              zone: $(ENVOY_SERVICE_ZONE)
           layered_runtime:
             layers:
             - name: global_config
@@ -85,7 +85,7 @@ spec:
                     load_balancing_weight: 1
                   load_balancing_weight: 1
                   locality:
-                    zone: "$(ENVOY_SERVICE_ZONE)"
+                    zone: $(ENVOY_SERVICE_ZONE)
               name: local_cluster
               type: STATIC
             - connect_timeout: 10s
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/extension-env.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/extension-env.yaml
index 47d98de04..f6a59ef15 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/extension-env.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/extension-env.yaml
@@ -51,7 +51,7 @@ spec:
             local_cluster_name: local_cluster
           node:
             locality:
-              zone: "$(ENVOY_SERVICE_ZONE)"
+              zone: $(ENVOY_SERVICE_ZONE)
           layered_runtime:
             layers:
             - name: global_config
@@ -136,7 +136,7 @@ spec:
                     load_balancing_weight: 1
                   load_balancing_weight: 1
                   locality:
-                    zone: "$(ENVOY_SERVICE_ZONE)"
+                    zone: $(ENVOY_SERVICE_ZONE)
               name: local_cluster
               type: STATIC
             - connect_timeout: 10s
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/gateway-namespace-mode.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/gateway-namespace-mode.yaml
index 336705faa..9cc6bf73e 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/gateway-namespace-mode.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/gateway-namespace-mode.yaml
@@ -56,7 +56,7 @@ spec:
             local_cluster_name: local_cluster
           node:
             locality:
-              zone: "$(ENVOY_SERVICE_ZONE)"
+              zone: $(ENVOY_SERVICE_ZONE)
           layered_runtime:
             layers:
             - name: global_config
@@ -141,7 +141,7 @@ spec:
                     load_balancing_weight: 1
                   load_balancing_weight: 1
                   locality:
-                    zone: "$(ENVOY_SERVICE_ZONE)"
+                    zone: $(ENVOY_SERVICE_ZONE)
               name: local_cluster
               type: STATIC
             - connect_timeout: 10s
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/override-labels-and-annotations.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/override-labels-and-annotations.yaml
index 335af4134..ddefe90b0 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/override-labels-and-annotations.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/override-labels-and-annotations.yaml
@@ -60,7 +60,7 @@ spec:
             local_cluster_name: local_cluster
           node:
             locality:
-              zone: "$(ENVOY_SERVICE_ZONE)"
+              zone: $(ENVOY_SERVICE_ZONE)
           layered_runtime:
             layers:
             - name: global_config
@@ -145,7 +145,7 @@ spec:
                     load_balancing_weight: 1
                   load_balancing_weight: 1
                   locality:
-                    zone: "$(ENVOY_SERVICE_ZONE)"
+                    zone: $(ENVOY_SERVICE_ZONE)
               name: local_cluster
               type: STATIC
             - connect_timeout: 10s
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/patch-daemonset.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/patch-daemonset.yaml
index 0a3df16c8..fdb1cd926 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/patch-daemonset.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/patch-daemonset.yaml
@@ -51,7 +51,7 @@ spec:
             local_cluster_name: local_cluster
           node:
             locality:
-              zone: "$(ENVOY_SERVICE_ZONE)"
+              zone: $(ENVOY_SERVICE_ZONE)
           layered_runtime:
             layers:
             - name: global_config
@@ -136,7 +136,7 @@ spec:
                     load_balancing_weight: 1
                   load_balancing_weight: 1
                   locality:
-                    zone: "$(ENVOY_SERVICE_ZONE)"
+                    zone: $(ENVOY_SERVICE_ZONE)
               name: local_cluster
               type: STATIC
             - connect_timeout: 10s
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/shutdown-manager.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/shutdown-manager.yaml
index 320588761..0cedfdb14 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/shutdown-manager.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/shutdown-manager.yaml
@@ -51,7 +51,7 @@ spec:
             local_cluster_name: local_cluster
           node:
             locality:
-              zone: "$(ENVOY_SERVICE_ZONE)"
+              zone: $(ENVOY_SERVICE_ZONE)
           layered_runtime:
             layers:
             - name: global_config
@@ -136,7 +136,7 @@ spec:
                     load_balancing_weight: 1
                   load_balancing_weight: 1
                   locality:
-                    zone: "$(ENVOY_SERVICE_ZONE)"
+                    zone: $(ENVOY_SERVICE_ZONE)
               name: local_cluster
               type: STATIC
             - connect_timeout: 10s
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/volumes.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/volumes.yaml
index 5d228dc1a..42fb53cf6 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/volumes.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/volumes.yaml
@@ -51,7 +51,7 @@ spec:
             local_cluster_name: local_cluster
           node:
             locality:
-              zone: "$(ENVOY_SERVICE_ZONE)"
+              zone: $(ENVOY_SERVICE_ZONE)
           layered_runtime:
             layers:
             - name: global_config
@@ -136,7 +136,7 @@ spec:
                     load_balancing_weight: 1
                   load_balancing_weight: 1
                   locality:
-                    zone: "$(ENVOY_SERVICE_ZONE)"
+                    zone: $(ENVOY_SERVICE_ZONE)
               name: local_cluster
               type: STATIC
             - connect_timeout: 10s
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-annotations.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-annotations.yaml
index 6a0ccedd3..7495912ed 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-annotations.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-annotations.yaml
@@ -56,7 +56,7 @@ spec:
             local_cluster_name: local_cluster
           node:
             locality:
-              zone: "$(ENVOY_SERVICE_ZONE)"
+              zone: $(ENVOY_SERVICE_ZONE)
           layered_runtime:
             layers:
             - name: global_config
@@ -141,7 +141,7 @@ spec:
                     load_balancing_weight: 1
                   load_balancing_weight: 1
                   locality:
-                    zone: "$(ENVOY_SERVICE_ZONE)"
+                    zone: $(ENVOY_SERVICE_ZONE)
               name: local_cluster
               type: STATIC
             - connect_timeout: 10s
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-extra-args.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-extra-args.yaml
index 82766a0ce..590835459 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-extra-args.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-extra-args.yaml
@@ -51,7 +51,7 @@ spec:
             local_cluster_name: local_cluster
           node:
             locality:
-              zone: "$(ENVOY_SERVICE_ZONE)"
+              zone: $(ENVOY_SERVICE_ZONE)
           layered_runtime:
             layers:
             - name: global_config
@@ -136,7 +136,7 @@ spec:
                     load_balancing_weight: 1
                   load_balancing_weight: 1
                   locality:
-                    zone: "$(ENVOY_SERVICE_ZONE)"
+                    zone: $(ENVOY_SERVICE_ZONE)
               name: local_cluster
               type: STATIC
             - connect_timeout: 10s
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-image-pull-secrets.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-image-pull-secrets.yaml
index ffaeaf550..279b03285 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-image-pull-secrets.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-image-pull-secrets.yaml
@@ -51,7 +51,7 @@ spec:
             local_cluster_name: local_cluster
           node:
             locality:
-              zone: "$(ENVOY_SERVICE_ZONE)"
+              zone: $(ENVOY_SERVICE_ZONE)
           layered_runtime:
             layers:
             - name: global_config
@@ -136,7 +136,7 @@ spec:
                     load_balancing_weight: 1
                   load_balancing_weight: 1
                   locality:
-                    zone: "$(ENVOY_SERVICE_ZONE)"
+                    zone: $(ENVOY_SERVICE_ZONE)
               name: local_cluster
               type: STATIC
             - connect_timeout: 10s
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-name.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-name.yaml
index 3c54978e5..5b461e56d 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-name.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-name.yaml
@@ -51,7 +51,7 @@ spec:
             local_cluster_name: local_cluster
           node:
             locality:
-              zone: "$(ENVOY_SERVICE_ZONE)"
+              zone: $(ENVOY_SERVICE_ZONE)
           layered_runtime:
             layers:
             - name: global_config
@@ -136,7 +136,7 @@ spec:
                     load_balancing_weight: 1
                   load_balancing_weight: 1
                   locality:
-                    zone: "$(ENVOY_SERVICE_ZONE)"
+                    zone: $(ENVOY_SERVICE_ZONE)
               name: local_cluster
               type: STATIC
             - connect_timeout: 10s
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-node-selector.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-node-selector.yaml
index a0f53dd75..0e8705737 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-node-selector.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-node-selector.yaml
@@ -51,7 +51,7 @@ spec:
             local_cluster_name: local_cluster
           node:
             locality:
-              zone: "$(ENVOY_SERVICE_ZONE)"
+              zone: $(ENVOY_SERVICE_ZONE)
           layered_runtime:
             layers:
             - name: global_config
@@ -136,7 +136,7 @@ spec:
                     load_balancing_weight: 1
                   load_balancing_weight: 1
                   locality:
-                    zone: "$(ENVOY_SERVICE_ZONE)"
+                    zone: $(ENVOY_SERVICE_ZONE)
               name: local_cluster
               type: STATIC
             - connect_timeout: 10s
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-topology-spread-constraints.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-topology-spread-constraints.yaml
index 1548efa17..0fb322439 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-topology-spread-constraints.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-topology-spread-constraints.yaml
@@ -51,7 +51,7 @@ spec:
             local_cluster_name: local_cluster
           node:
             locality:
-              zone: "$(ENVOY_SERVICE_ZONE)"
+              zone: $(ENVOY_SERVICE_ZONE)
           layered_runtime:
             layers:
             - name: global_config
@@ -136,7 +136,7 @@ spec:
                     load_balancing_weight: 1
                   load_balancing_weight: 1
                   locality:
-                    zone: "$(ENVOY_SERVICE_ZONE)"
+                    zone: $(ENVOY_SERVICE_ZONE)
               name: local_cluster
               type: STATIC
             - connect_timeout: 10s
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/custom.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/custom.yaml
index 1f09bd450..b93281c30 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/custom.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/custom.yaml
@@ -57,7 +57,7 @@ spec:
             local_cluster_name: local_cluster
           node:
             locality:
-              zone: "$(ENVOY_SERVICE_ZONE)"
+              zone: $(ENVOY_SERVICE_ZONE)
           layered_runtime:
             layers:
             - name: global_config
@@ -142,7 +142,7 @@ spec:
                     load_balancing_weight: 1
                   load_balancing_weight: 1
                   locality:
-                    zone: "$(ENVOY_SERVICE_ZONE)"
+                    zone: $(ENVOY_SERVICE_ZONE)
               name: local_cluster
               type: STATIC
             - connect_timeout: 10s
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/custom_with_initcontainers.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/custom_with_initcontainers.yaml
index b646e3740..99d3b24f2 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/custom_with_initcontainers.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/custom_with_initcontainers.yaml
@@ -57,7 +57,7 @@ spec:
             local_cluster_name: local_cluster
           node:
             locality:
-              zone: "$(ENVOY_SERVICE_ZONE)"
+              zone: $(ENVOY_SERVICE_ZONE)
           layered_runtime:
             layers:
             - name: global_config
@@ -142,7 +142,7 @@ spec:
                     load_balancing_weight: 1
                   load_balancing_weight: 1
                   locality:
-                    zone: "$(ENVOY_SERVICE_ZONE)"
+                    zone: $(ENVOY_SERVICE_ZONE)
               name: local_cluster
               type: STATIC
             - connect_timeout: 10s
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/default-env.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/default-env.yaml
index bee965059..b338506c9 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/default-env.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/default-env.yaml
@@ -56,7 +56,7 @@ spec:
             local_cluster_name: local_cluster
           node:
             locality:
-              zone: "$(ENVOY_SERVICE_ZONE)"
+              zone: $(ENVOY_SERVICE_ZONE)
           layered_runtime:
             layers:
             - name: global_config
@@ -141,7 +141,7 @@ spec:
                     load_balancing_weight: 1
                   load_balancing_weight: 1
                   locality:
-                    zone: "$(ENVOY_SERVICE_ZONE)"
+                    zone: $(ENVOY_SERVICE_ZONE)
               name: local_cluster
               type: STATIC
             - connect_timeout: 10s
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/default.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/default.yaml
index 538a83777..fa52c6862 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/default.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/default.yaml
@@ -55,7 +55,7 @@ spec:
             local_cluster_name: local_cluster
           node:
             locality:
-              zone: "$(ENVOY_SERVICE_ZONE)"
+              zone: $(ENVOY_SERVICE_ZONE)
           layered_runtime:
             layers:
             - name: global_config
@@ -140,7 +140,7 @@ spec:
                     load_balancing_weight: 1
                   load_balancing_weight: 1
                   locality:
-                    zone: "$(ENVOY_SERVICE_ZONE)"
+                    zone: $(ENVOY_SERVICE_ZONE)
               name: local_cluster
               type: STATIC
             - connect_timeout: 10s
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/disable-prometheus.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/disable-prometheus.yaml
index 762d42e5f..e32820f4c 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/disable-prometheus.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/disable-prometheus.yaml
@@ -51,7 +51,7 @@ spec:
             local_cluster_name: local_cluster
           node:
             locality:
-              zone: "$(ENVOY_SERVICE_ZONE)"
+              zone: $(ENVOY_SERVICE_ZONE)
           layered_runtime:
             layers:
             - name: global_config
@@ -89,7 +89,7 @@ spec:
                     load_balancing_weight: 1
                   load_balancing_weight: 1
                   locality:
-                    zone: "$(ENVOY_SERVICE_ZONE)"
+                    zone: $(ENVOY_SERVICE_ZONE)
               name: local_cluster
               type: STATIC
             - connect_timeout: 10s
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/dual-stack.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/dual-stack.yaml
index 41f290234..8b2443e75 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/dual-stack.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/dual-stack.yaml
@@ -55,7 +55,7 @@ spec:
             local_cluster_name: local_cluster
           node:
             locality:
-              zone: "$(ENVOY_SERVICE_ZONE)"
+              zone: $(ENVOY_SERVICE_ZONE)
           layered_runtime:
             layers:
             - name: global_config
@@ -141,7 +141,7 @@ spec:
                     load_balancing_weight: 1
                   load_balancing_weight: 1
                   locality:
-                    zone: "$(ENVOY_SERVICE_ZONE)"
+                    zone: $(ENVOY_SERVICE_ZONE)
               name: local_cluster
               type: STATIC
             - connect_timeout: 10s
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/extension-env.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/extension-env.yaml
index 034697656..631aba61f 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/extension-env.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/extension-env.yaml
@@ -56,7 +56,7 @@ spec:
             local_cluster_name: local_cluster
           node:
             locality:
-              zone: "$(ENVOY_SERVICE_ZONE)"
+              zone: $(ENVOY_SERVICE_ZONE)
           layered_runtime:
             layers:
             - name: global_config
@@ -141,7 +141,7 @@ spec:
                     load_balancing_weight: 1
                   load_balancing_weight: 1
                   locality:
-                    zone: "$(ENVOY_SERVICE_ZONE)"
+                    zone: $(ENVOY_SERVICE_ZONE)
               name: local_cluster
               type: STATIC
             - connect_timeout: 10s
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/gateway-namespace-mode.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/gateway-namespace-mode.yaml
index c32da9e94..969057ace 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/gateway-namespace-mode.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/gateway-namespace-mode.yaml
@@ -60,7 +60,7 @@ spec:
             local_cluster_name: local_cluster
           node:
             locality:
-              zone: "$(ENVOY_SERVICE_ZONE)"
+              zone: $(ENVOY_SERVICE_ZONE)
           layered_runtime:
             layers:
             - name: global_config
@@ -145,7 +145,7 @@ spec:
                     load_balancing_weight: 1
                   load_balancing_weight: 1
                   locality:
-                    zone: "$(ENVOY_SERVICE_ZONE)"
+                    zone: $(ENVOY_SERVICE_ZONE)
               name: local_cluster
               type: STATIC
             - connect_timeout: 10s
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/ipv6.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/ipv6.yaml
index 37d053e03..ae2405c92 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/ipv6.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/ipv6.yaml
@@ -55,7 +55,7 @@ spec:
             local_cluster_name: local_cluster
           node:
             locality:
-              zone: "$(ENVOY_SERVICE_ZONE)"
+              zone: $(ENVOY_SERVICE_ZONE)
           layered_runtime:
             layers:
             - name: global_config
@@ -141,7 +141,7 @@ spec:
                     load_balancing_weight: 1
                   load_balancing_weight: 1
                   locality:
-                    zone: "$(ENVOY_SERVICE_ZONE)"
+                    zone: $(ENVOY_SERVICE_ZONE)
               name: local_cluster
               type: STATIC
             - connect_timeout: 10s
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/override-labels-and-annotations.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/override-labels-and-annotations.yaml
index 460174656..4200837e6 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/override-labels-and-annotations.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/override-labels-and-annotations.yaml
@@ -64,7 +64,7 @@ spec:
             local_cluster_name: local_cluster
           node:
             locality:
-              zone: "$(ENVOY_SERVICE_ZONE)"
+              zone: $(ENVOY_SERVICE_ZONE)
           layered_runtime:
             layers:
             - name: global_config
@@ -149,7 +149,7 @@ spec:
                     load_balancing_weight: 1
                   load_balancing_weight: 1
                   locality:
-                    zone: "$(ENVOY_SERVICE_ZONE)"
+                    zone: $(ENVOY_SERVICE_ZONE)
               name: local_cluster
               type: STATIC
             - connect_timeout: 10s
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/patch-deployment.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/patch-deployment.yaml
index 1586d258a..fe7d322b8 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/patch-deployment.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/patch-deployment.yaml
@@ -55,7 +55,7 @@ spec:
             local_cluster_name: local_cluster
           node:
             locality:
-              zone: "$(ENVOY_SERVICE_ZONE)"
+              zone: $(ENVOY_SERVICE_ZONE)
           layered_runtime:
             layers:
             - name: global_config
@@ -140,7 +140,7 @@ spec:
                     load_balancing_weight: 1
                   load_balancing_weight: 1
                   locality:
-                    zone: "$(ENVOY_SERVICE_ZONE)"
+                    zone: $(ENVOY_SERVICE_ZONE)
               name: local_cluster
               type: STATIC
             - connect_timeout: 10s
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/shutdown-manager.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/shutdown-manager.yaml
index 90cfd5c37..c87d95c8b 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/shutdown-manager.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/shutdown-manager.yaml
@@ -55,7 +55,7 @@ spec:
             local_cluster_name: local_cluster
           node:
             locality:
-              zone: "$(ENVOY_SERVICE_ZONE)"
+              zone: $(ENVOY_SERVICE_ZONE)
           layered_runtime:
             layers:
             - name: global_config
@@ -140,7 +140,7 @@ spec:
                     load_balancing_weight: 1
                   load_balancing_weight: 1
                   locality:
-                    zone: "$(ENVOY_SERVICE_ZONE)"
+                    zone: $(ENVOY_SERVICE_ZONE)
               name: local_cluster
               type: STATIC
             - connect_timeout: 10s
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/volumes.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/volumes.yaml
index d2df4f785..6eecc815b 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/volumes.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/volumes.yaml
@@ -56,7 +56,7 @@ spec:
             local_cluster_name: local_cluster
           node:
             locality:
-              zone: "$(ENVOY_SERVICE_ZONE)"
+              zone: $(ENVOY_SERVICE_ZONE)
           layered_runtime:
             layers:
             - name: global_config
@@ -141,7 +141,7 @@ spec:
                     load_balancing_weight: 1
                   load_balancing_weight: 1
                   locality:
-                    zone: "$(ENVOY_SERVICE_ZONE)"
+                    zone: $(ENVOY_SERVICE_ZONE)
               name: local_cluster
               type: STATIC
             - connect_timeout: 10s
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-annotations.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-annotations.yaml
index ae5d29392..f88b710cf 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-annotations.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-annotations.yaml
@@ -60,7 +60,7 @@ spec:
             local_cluster_name: local_cluster
           node:
             locality:
-              zone: "$(ENVOY_SERVICE_ZONE)"
+              zone: $(ENVOY_SERVICE_ZONE)
           layered_runtime:
             layers:
             - name: global_config
@@ -145,7 +145,7 @@ spec:
                     load_balancing_weight: 1
                   load_balancing_weight: 1
                   locality:
-                    zone: "$(ENVOY_SERVICE_ZONE)"
+                    zone: $(ENVOY_SERVICE_ZONE)
               name: local_cluster
               type: STATIC
             - connect_timeout: 10s
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-empty-memory-limits.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-empty-memory-limits.yaml
index 0e4d831cd..31f98d5e0 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-empty-memory-limits.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-empty-memory-limits.yaml
@@ -55,7 +55,7 @@ spec:
             local_cluster_name: local_cluster
           node:
             locality:
-              zone: "$(ENVOY_SERVICE_ZONE)"
+              zone: $(ENVOY_SERVICE_ZONE)
           layered_runtime:
             layers:
             - name: global_config
@@ -140,7 +140,7 @@ spec:
                     load_balancing_weight: 1
                   load_balancing_weight: 1
                   locality:
-                    zone: "$(ENVOY_SERVICE_ZONE)"
+                    zone: $(ENVOY_SERVICE_ZONE)
               name: local_cluster
               type: STATIC
             - connect_timeout: 10s
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-extra-args.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-extra-args.yaml
index 589bbb911..5d8cb792a 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-extra-args.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-extra-args.yaml
@@ -55,7 +55,7 @@ spec:
             local_cluster_name: local_cluster
           node:
             locality:
-              zone: "$(ENVOY_SERVICE_ZONE)"
+              zone: $(ENVOY_SERVICE_ZONE)
           layered_runtime:
             layers:
             - name: global_config
@@ -140,7 +140,7 @@ spec:
                     load_balancing_weight: 1
                   load_balancing_weight: 1
                   locality:
-                    zone: "$(ENVOY_SERVICE_ZONE)"
+                    zone: $(ENVOY_SERVICE_ZONE)
               name: local_cluster
               type: STATIC
             - connect_timeout: 10s
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-image-pull-secrets.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-image-pull-secrets.yaml
index c723c4f0b..9fd95327a 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-image-pull-secrets.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-image-pull-secrets.yaml
@@ -55,7 +55,7 @@ spec:
             local_cluster_name: local_cluster
           node:
             locality:
-              zone: "$(ENVOY_SERVICE_ZONE)"
+              zone: $(ENVOY_SERVICE_ZONE)
           layered_runtime:
             layers:
             - name: global_config
@@ -140,7 +140,7 @@ spec:
                     load_balancing_weight: 1
                   load_balancing_weight: 1
                   locality:
-                    zone: "$(ENVOY_SERVICE_ZONE)"
+                    zone: $(ENVOY_SERVICE_ZONE)
               name: local_cluster
               type: STATIC
             - connect_timeout: 10s
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-name.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-name.yaml
index 212acfc74..a514ea8cf 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-name.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-name.yaml
@@ -55,7 +55,7 @@ spec:
             local_cluster_name: local_cluster
           node:
             locality:
-              zone: "$(ENVOY_SERVICE_ZONE)"
+              zone: $(ENVOY_SERVICE_ZONE)
           layered_runtime:
             layers:
             - name: global_config
@@ -140,7 +140,7 @@ spec:
                     load_balancing_weight: 1
                   load_balancing_weight: 1
                   locality:
-                    zone: "$(ENVOY_SERVICE_ZONE)"
+                    zone: $(ENVOY_SERVICE_ZONE)
               name: local_cluster
               type: STATIC
             - connect_timeout: 10s
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-node-selector.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-node-selector.yaml
index 81479bbd4..7748279a7 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-node-selector.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-node-selector.yaml
@@ -55,7 +55,7 @@ spec:
             local_cluster_name: local_cluster
           node:
             locality:
-              zone: "$(ENVOY_SERVICE_ZONE)"
+              zone: $(ENVOY_SERVICE_ZONE)
           layered_runtime:
             layers:
             - name: global_config
@@ -140,7 +140,7 @@ spec:
                     load_balancing_weight: 1
                   load_balancing_weight: 1
                   locality:
-                    zone: "$(ENVOY_SERVICE_ZONE)"
+                    zone: $(ENVOY_SERVICE_ZONE)
               name: local_cluster
               type: STATIC
             - connect_timeout: 10s
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-topology-spread-constraints.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-topology-spread-constraints.yaml
index 182b1407a..fcda05eeb 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-topology-spread-constraints.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-topology-spread-constraints.yaml
@@ -55,7 +55,7 @@ spec:
             local_cluster_name: local_cluster
           node:
             locality:
-              zone: "$(ENVOY_SERVICE_ZONE)"
+              zone: $(ENVOY_SERVICE_ZONE)
           layered_runtime:
             layers:
             - name: global_config
@@ -140,7 +140,7 @@ spec:
                     load_balancing_weight: 1
                   load_balancing_weight: 1
                   locality:
-                    zone: "$(ENVOY_SERVICE_ZONE)"
+                    zone: $(ENVOY_SERVICE_ZONE)
               name: local_cluster
               type: STATIC
             - connect_timeout: 10s
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/gateway-namespace-mode/deployment.yaml b/internal/infrastructure/kubernetes/proxy/testdata/gateway-namespace-mode/deployment.yaml
index 0483bd7fd..710787b20 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/gateway-namespace-mode/deployment.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/gateway-namespace-mode/deployment.yaml
@@ -60,7 +60,7 @@ spec:
             local_cluster_name: local_cluster
           node:
             locality:
-              zone: "$(ENVOY_SERVICE_ZONE)"
+              zone: $(ENVOY_SERVICE_ZONE)
           layered_runtime:
             layers:
             - name: global_config
@@ -145,7 +145,7 @@ spec:
                     load_balancing_weight: 1
                   load_balancing_weight: 1
                   locality:
-                    zone: "$(ENVOY_SERVICE_ZONE)"
+                    zone: $(ENVOY_SERVICE_ZONE)
               name: local_cluster
               type: STATIC
             - connect_timeout: 10s
@@ -464,7 +464,7 @@ spec:
             local_cluster_name: local_cluster
           node:
             locality:
-              zone: "$(ENVOY_SERVICE_ZONE)"
+              zone: $(ENVOY_SERVICE_ZONE)
           layered_runtime:
             layers:
             - name: global_config
@@ -549,7 +549,7 @@ spec:
                     load_balancing_weight: 1
                   load_balancing_weight: 1
                   locality:
-                    zone: "$(ENVOY_SERVICE_ZONE)"
+                    zone: $(ENVOY_SERVICE_ZONE)
               name: local_cluster
               type: STATIC
             - connect_timeout: 10s
diff --git a/internal/provider/kubernetes/topology_injector_test.go b/internal/provider/kubernetes/topology_injector_test.go
index 6128214a8..399229c4a 100644
--- a/internal/provider/kubernetes/topology_injector_test.go
+++ b/internal/provider/kubernetes/topology_injector_test.go
@@ -41,7 +41,7 @@ func TestProxyTopologyInjector_Handle(t *testing.T) {
 	defaultNode := &corev1.Node{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:   "node-A",
-			Labels: map[string]string{corev1.LabelTopologyZone: "zone1"},
+			Labels: map[string]string{corev1.LabelTopologyZone: "0"},
 		},
 	}
 
@@ -67,7 +67,7 @@ func TestProxyTopologyInjector_Handle(t *testing.T) {
 				Operation: "add",
 				Path:      "/metadata/annotations",
 				Value: map[string]interface{}{
-					"topology.kubernetes.io/zone": "zone1",
+					"topology.kubernetes.io/zone": "\"0\"",
 				},
 			}},
 		},
diff --git a/internal/xds/bootstrap/testdata/render/custom-server-port.yaml b/internal/xds/bootstrap/testdata/render/custom-server-port.yaml
index ab036892e..94586a1f0 100644
--- a/internal/xds/bootstrap/testdata/render/custom-server-port.yaml
+++ b/internal/xds/bootstrap/testdata/render/custom-server-port.yaml
@@ -12,7 +12,7 @@ cluster_manager:
   local_cluster_name: local_cluster
 node:
   locality:
-    zone: "$(ENVOY_SERVICE_ZONE)"
+    zone: $(ENVOY_SERVICE_ZONE)
 layered_runtime:
   layers:
   - name: global_config
@@ -97,7 +97,7 @@ static_resources:
           load_balancing_weight: 1
         load_balancing_weight: 1
         locality:
-          zone: "$(ENVOY_SERVICE_ZONE)"
+          zone: $(ENVOY_SERVICE_ZONE)
     name: local_cluster
     type: STATIC
   - connect_timeout: 10s
diff --git a/internal/xds/bootstrap/testdata/render/custom-stats-matcher.yaml b/internal/xds/bootstrap/testdata/render/custom-stats-matcher.yaml
index 525ad200a..a0cef5eb6 100644
--- a/internal/xds/bootstrap/testdata/render/custom-stats-matcher.yaml
+++ b/internal/xds/bootstrap/testdata/render/custom-stats-matcher.yaml
@@ -12,7 +12,7 @@ cluster_manager:
   local_cluster_name: local_cluster
 node:
   locality:
-    zone: "$(ENVOY_SERVICE_ZONE)"
+    zone: $(ENVOY_SERVICE_ZONE)
 stats_config:
   stats_matcher:
     inclusion_list:
@@ -108,7 +108,7 @@ static_resources:
           load_balancing_weight: 1
         load_balancing_weight: 1
         locality:
-          zone: "$(ENVOY_SERVICE_ZONE)"
+          zone: $(ENVOY_SERVICE_ZONE)
     name: local_cluster
     type: STATIC
   - connect_timeout: 10s
diff --git a/internal/xds/bootstrap/testdata/render/disable-prometheus.yaml b/internal/xds/bootstrap/testdata/render/disable-prometheus.yaml
index 0ae906b71..00f493acc 100644
--- a/internal/xds/bootstrap/testdata/render/disable-prometheus.yaml
+++ b/internal/xds/bootstrap/testdata/render/disable-prometheus.yaml
@@ -12,7 +12,7 @@ cluster_manager:
   local_cluster_name: local_cluster
 node:
   locality:
-    zone: "$(ENVOY_SERVICE_ZONE)"
+    zone: $(ENVOY_SERVICE_ZONE)
 layered_runtime:
   layers:
   - name: global_config
@@ -50,7 +50,7 @@ static_resources:
           load_balancing_weight: 1
         load_balancing_weight: 1
         locality:
-          zone: "$(ENVOY_SERVICE_ZONE)"
+          zone: $(ENVOY_SERVICE_ZONE)
     name: local_cluster
     type: STATIC
   - connect_timeout: 10s
diff --git a/internal/xds/bootstrap/testdata/render/enable-prometheus-brotli-compression.yaml b/internal/xds/bootstrap/testdata/render/enable-prometheus-brotli-compression.yaml
index 0866561b9..936b6b520 100644
--- a/internal/xds/bootstrap/testdata/render/enable-prometheus-brotli-compression.yaml
+++ b/internal/xds/bootstrap/testdata/render/enable-prometheus-brotli-compression.yaml
@@ -12,7 +12,7 @@ cluster_manager:
   local_cluster_name: local_cluster
 node:
   locality:
-    zone: "$(ENVOY_SERVICE_ZONE)"
+    zone: $(ENVOY_SERVICE_ZONE)
 layered_runtime:
   layers:
   - name: global_config
@@ -113,7 +113,7 @@ static_resources:
           load_balancing_weight: 1
         load_balancing_weight: 1
         locality:
-          zone: "$(ENVOY_SERVICE_ZONE)"
+          zone: $(ENVOY_SERVICE_ZONE)
     name: local_cluster
     type: STATIC
   - connect_timeout: 10s
diff --git a/internal/xds/bootstrap/testdata/render/enable-prometheus-gzip-compression.yaml b/internal/xds/bootstrap/testdata/render/enable-prometheus-gzip-compression.yaml
index 00c0230d6..b4e898497 100644
--- a/internal/xds/bootstrap/testdata/render/enable-prometheus-gzip-compression.yaml
+++ b/internal/xds/bootstrap/testdata/render/enable-prometheus-gzip-compression.yaml
@@ -12,7 +12,7 @@ cluster_manager:
   local_cluster_name: local_cluster
 node:
   locality:
-    zone: "$(ENVOY_SERVICE_ZONE)"
+    zone: $(ENVOY_SERVICE_ZONE)
 layered_runtime:
   layers:
   - name: global_config
@@ -113,7 +113,7 @@ static_resources:
           load_balancing_weight: 1
         load_balancing_weight: 1
         locality:
-          zone: "$(ENVOY_SERVICE_ZONE)"
+          zone: $(ENVOY_SERVICE_ZONE)
     name: local_cluster
     type: STATIC
   - connect_timeout: 10s
diff --git a/internal/xds/bootstrap/testdata/render/enable-prometheus.yaml b/internal/xds/bootstrap/testdata/render/enable-prometheus.yaml
index b32ad36fe..a974728e6 100644
--- a/internal/xds/bootstrap/testdata/render/enable-prometheus.yaml
+++ b/internal/xds/bootstrap/testdata/render/enable-prometheus.yaml
@@ -12,7 +12,7 @@ cluster_manager:
   local_cluster_name: local_cluster
 node:
   locality:
-    zone: "$(ENVOY_SERVICE_ZONE)"
+    zone: $(ENVOY_SERVICE_ZONE)
 layered_runtime:
   layers:
   - name: global_config
@@ -97,7 +97,7 @@ static_resources:
           load_balancing_weight: 1
         load_balancing_weight: 1
         locality:
-          zone: "$(ENVOY_SERVICE_ZONE)"
+          zone: $(ENVOY_SERVICE_ZONE)
     name: local_cluster
     type: STATIC
   - connect_timeout: 10s
diff --git a/internal/xds/bootstrap/testdata/render/ipv6.yaml b/internal/xds/bootstrap/testdata/render/ipv6.yaml
index 436710a88..ce56cc6ab 100644
--- a/internal/xds/bootstrap/testdata/render/ipv6.yaml
+++ b/internal/xds/bootstrap/testdata/render/ipv6.yaml
@@ -12,7 +12,7 @@ cluster_manager:
   local_cluster_name: local_cluster
 node:
   locality:
-    zone: "$(ENVOY_SERVICE_ZONE)"
+    zone: $(ENVOY_SERVICE_ZONE)
 layered_runtime:
   layers:
   - name: global_config
@@ -98,7 +98,7 @@ static_resources:
           load_balancing_weight: 1
         load_balancing_weight: 1
         locality:
-          zone: "$(ENVOY_SERVICE_ZONE)"
+          zone: $(ENVOY_SERVICE_ZONE)
     name: local_cluster
     type: STATIC
   - connect_timeout: 10s
diff --git a/internal/xds/bootstrap/testdata/render/otel-metrics-backendref.yaml b/internal/xds/bootstrap/testdata/render/otel-metrics-backendref.yaml
index dcd84799b..b3b2f9b53 100644
--- a/internal/xds/bootstrap/testdata/render/otel-metrics-backendref.yaml
+++ b/internal/xds/bootstrap/testdata/render/otel-metrics-backendref.yaml
@@ -12,7 +12,7 @@ cluster_manager:
   local_cluster_name: local_cluster
 node:
   locality:
-    zone: "$(ENVOY_SERVICE_ZONE)"
+    zone: $(ENVOY_SERVICE_ZONE)
 layered_runtime:
   layers:
   - name: global_config
@@ -75,7 +75,7 @@ static_resources:
           load_balancing_weight: 1
         load_balancing_weight: 1
         locality:
-          zone: "$(ENVOY_SERVICE_ZONE)"
+          zone: $(ENVOY_SERVICE_ZONE)
     name: local_cluster
     type: STATIC
   - connect_timeout: 10s
diff --git a/internal/xds/bootstrap/testdata/render/otel-metrics.yaml b/internal/xds/bootstrap/testdata/render/otel-metrics.yaml
index dcd84799b..b3b2f9b53 100644
--- a/internal/xds/bootstrap/testdata/render/otel-metrics.yaml
+++ b/internal/xds/bootstrap/testdata/render/otel-metrics.yaml
@@ -12,7 +12,7 @@ cluster_manager:
   local_cluster_name: local_cluster
 node:
   locality:
-    zone: "$(ENVOY_SERVICE_ZONE)"
+    zone: $(ENVOY_SERVICE_ZONE)
 layered_runtime:
   layers:
   - name: global_config
@@ -75,7 +75,7 @@ static_resources:
           load_balancing_weight: 1
         load_balancing_weight: 1
         locality:
-          zone: "$(ENVOY_SERVICE_ZONE)"
+          zone: $(ENVOY_SERVICE_ZONE)
     name: local_cluster
     type: STATIC
   - connect_timeout: 10s
diff --git a/internal/xds/bootstrap/testdata/render/with-max-heap-size-bytes.yaml b/internal/xds/bootstrap/testdata/render/with-max-heap-size-bytes.yaml
index 26e54e4e7..33b2a460c 100644
--- a/internal/xds/bootstrap/testdata/render/with-max-heap-size-bytes.yaml
+++ b/internal/xds/bootstrap/testdata/render/with-max-heap-size-bytes.yaml
@@ -12,7 +12,7 @@ cluster_manager:
   local_cluster_name: local_cluster
 node:
   locality:
-    zone: "$(ENVOY_SERVICE_ZONE)"
+    zone: $(ENVOY_SERVICE_ZONE)
 layered_runtime:
   layers:
   - name: global_config
@@ -97,7 +97,7 @@ static_resources:
           load_balancing_weight: 1
         load_balancing_weight: 1
         locality:
-          zone: "$(ENVOY_SERVICE_ZONE)"
+          zone: $(ENVOY_SERVICE_ZONE)
     name: local_cluster
     type: STATIC
   - connect_timeout: 10s
diff --git a/site/content/en/latest/api/extension_types.md b/site/content/en/latest/api/extension_types.md
index 21ec2302d..657a643f0 100644
--- a/site/content/en/latest/api/extension_types.md
+++ b/site/content/en/latest/api/extension_types.md
@@ -2095,6 +2095,7 @@ _Appears in:_
 
 | Field | Type | Required | Default | Description |
 | ---   | ---  | ---      | ---     | ---         |
+| `hostname` | _string_ |  true  |  | Hostname defines the HTTP host that will be requested during health checking.<br />Default: HTTPRoute or GRPCRoute hostname. |
 | `path` | _string_ |  true  |  | Path defines the HTTP path that will be requested during health checking. |
 | `method` | _string_ |  false  |  | Method defines the HTTP method used for health checking.<br />Defaults to GET |
 | `expectedStatuses` | _[HTTPStatus](#httpstatus) array_ |  false  |  | ExpectedStatuses defines a list of HTTP response statuses considered healthy.<br />Defaults to 200 only |
diff --git a/test/e2e/tests/local_ratelimit.go b/test/e2e/tests/local_ratelimit.go
index 18fa6e4ab..a077e8aa9 100644
--- a/test/e2e/tests/local_ratelimit.go
+++ b/test/e2e/tests/local_ratelimit.go
@@ -30,8 +30,15 @@ func init() {
 const (
 	RatelimitLimitHeaderName     = "x-ratelimit-limit"
 	RatelimitRemainingHeaderName = "x-ratelimit-remaining"
+	RatelimitResetHeaderName     = "x-ratelimit-reset"
 )
 
+var allRateLimitHeaders = []string{
+	RatelimitLimitHeaderName,
+	RatelimitRemainingHeaderName,
+	RatelimitResetHeaderName,
+}
+
 var LocalRateLimitTest = suite.ConformanceTest{
 	ShortName:   "LocalRateLimit",
 	Description: "Make sure local rate limit work",
@@ -39,16 +46,19 @@ var LocalRateLimitTest = suite.ConformanceTest{
 	Test: func(t *testing.T, suite *suite.ConformanceTestSuite) {
 		for _, disableHeader := range []bool{true, false} {
 			runNoRateLimitTest(t, suite, disableHeader)
-
-			t.Run(fmt.Sprintf("SpecificUser-%t", disableHeader), func(t *testing.T) {
+			caseSuffix := "disableHeader"
+			if !disableHeader {
+				caseSuffix = "withHeader"
+			}
+			t.Run(fmt.Sprintf("SpecificUser-%s", caseSuffix), func(t *testing.T) {
 				runSpecificUserRateLimitTest(t, suite, disableHeader)
 			})
 
-			t.Run(fmt.Sprintf("AllTraffic-%t", disableHeader), func(t *testing.T) {
+			t.Run(fmt.Sprintf("AllTraffic-%s", caseSuffix), func(t *testing.T) {
 				runAllTrafficRateLimitTest(t, suite, disableHeader)
 			})
 
-			t.Run(fmt.Sprintf("HeaderInvertMatch-%t", disableHeader), func(t *testing.T) {
+			t.Run(fmt.Sprintf("HeaderInvertMatch-%s", caseSuffix), func(t *testing.T) {
 				runHeaderInvertMatchRateLimitTest(t, suite, disableHeader)
 			})
 		}
@@ -87,19 +97,19 @@ func runNoRateLimitTest(t *testing.T, suite *suite.ConformanceTestSuite, disable
 		},
 		Response: http.Response{
 			StatusCode:    200,
-			AbsentHeaders: []string{RatelimitLimitHeaderName, RatelimitRemainingHeaderName},
+			AbsentHeaders: allRateLimitHeaders,
 		},
 		Namespace: ns,
 	}
 
 	// keep sending requests till get 200 first, that will cost one 200
-	utils.MakeRequestAndExpectEventuallyConsistentResponse(t, suite, gwAddr, expectOkResp)
+	http.MakeRequestAndExpectEventuallyConsistentResponse(t, suite.RoundTripper, suite.TimeoutConfig, gwAddr, expectOkResp)
 
 	// send 10+ more
 	total := 10
 	for total > 0 {
 		// keep sending requests till get 200 first, that will cost one 200
-		utils.MakeRequestAndExpectEventuallyConsistentResponse(t, suite, gwAddr, expectOkResp)
+		http.MakeRequestAndExpectEventuallyConsistentResponse(t, suite.RoundTripper, suite.TimeoutConfig, gwAddr, expectOkResp)
 		total--
 	}
 }
@@ -134,10 +144,13 @@ func runSpecificUserRateLimitTest(t *testing.T, suite *suite.ConformanceTestSuit
 	if !disableHeader {
 		okResponse.Response.Headers = map[string]string{
 			RatelimitLimitHeaderName:     "3",
-			RatelimitRemainingHeaderName: "", // empty string means we don't care about the value
+			RatelimitRemainingHeaderName: "1",
+			RatelimitResetHeaderName:     "0",
 		}
+	} else {
+		okResponse.Response.AbsentHeaders = allRateLimitHeaders
 	}
-	utils.MakeRequestAndExpectEventuallyConsistentResponse(t, suite, gwAddr, okResponse)
+	http.MakeRequestAndExpectEventuallyConsistentResponse(t, suite.RoundTripper, suite.TimeoutConfig, gwAddr, okResponse)
 
 	// this request should be limited because the user is john
 	limitResponse := http.ExpectedResponse{
@@ -154,11 +167,13 @@ func runSpecificUserRateLimitTest(t *testing.T, suite *suite.ConformanceTestSuit
 	}
 	if !disableHeader {
 		limitResponse.Response.Headers = map[string]string{
-			RatelimitLimitHeaderName:     "4",
-			RatelimitRemainingHeaderName: "0", // at the end the remaining should be 0
+			RatelimitLimitHeaderName:     "3",
+			RatelimitRemainingHeaderName: "0",
 		}
+	} else {
+		limitResponse.Response.AbsentHeaders = allRateLimitHeaders
 	}
-	utils.MakeRequestAndExpectEventuallyConsistentResponse(t, suite, gwAddr, limitResponse)
+	http.MakeRequestAndExpectEventuallyConsistentResponse(t, suite.RoundTripper, suite.TimeoutConfig, gwAddr, limitResponse)
 
 	// this request should not be limited because the user is not john hit default bucket
 	notJohnResponse := http.ExpectedResponse{
@@ -177,9 +192,12 @@ func runSpecificUserRateLimitTest(t *testing.T, suite *suite.ConformanceTestSuit
 		notJohnResponse.Response.Headers = map[string]string{
 			RatelimitLimitHeaderName:     "10",
 			RatelimitRemainingHeaderName: "2", // there almost 8 requests before reach this
+			RatelimitResetHeaderName:     "0",
 		}
+	} else {
+		notJohnResponse.Response.AbsentHeaders = allRateLimitHeaders
 	}
-	utils.MakeRequestAndExpectEventuallyConsistentResponse(t, suite, gwAddr, notJohnResponse)
+	http.MakeRequestAndExpectEventuallyConsistentResponse(t, suite.RoundTripper, suite.TimeoutConfig, gwAddr, notJohnResponse)
 
 	// In the end it will hit the limit
 	notJohnLimitResponse := http.ExpectedResponse{
@@ -190,10 +208,6 @@ func runSpecificUserRateLimitTest(t *testing.T, suite *suite.ConformanceTestSuit
 			},
 		},
 		Response: http.Response{
-			Headers: map[string]string{
-				RatelimitLimitHeaderName:     "10",
-				RatelimitRemainingHeaderName: "0", // it will be limited at the end
-			},
 			StatusCode: 429,
 		},
 		Namespace: ns,
@@ -203,8 +217,10 @@ func runSpecificUserRateLimitTest(t *testing.T, suite *suite.ConformanceTestSuit
 			RatelimitLimitHeaderName:     "10",
 			RatelimitRemainingHeaderName: "0", // it will be limited at the end
 		}
+	} else {
+		notJohnLimitResponse.Response.AbsentHeaders = allRateLimitHeaders
 	}
-	utils.MakeRequestAndExpectEventuallyConsistentResponse(t, suite, gwAddr, notJohnLimitResponse)
+	http.MakeRequestAndExpectEventuallyConsistentResponse(t, suite.RoundTripper, suite.TimeoutConfig, gwAddr, notJohnLimitResponse)
 }
 
 func runAllTrafficRateLimitTest(t *testing.T, suite *suite.ConformanceTestSuite, disableHeader bool) {
@@ -232,11 +248,14 @@ func runAllTrafficRateLimitTest(t *testing.T, suite *suite.ConformanceTestSuite,
 	if !disableHeader {
 		okResponse.Response.Headers = map[string]string{
 			RatelimitLimitHeaderName:     "3",
-			RatelimitRemainingHeaderName: "", // empty string means we don't care about the value
+			RatelimitRemainingHeaderName: "1",
+			RatelimitResetHeaderName:     "0",
 		}
+	} else {
+		okResponse.Response.AbsentHeaders = allRateLimitHeaders
 	}
 	// keep sending requests till get 200 first, that will cost one 200
-	utils.MakeRequestAndExpectEventuallyConsistentResponse(t, suite, gwAddr, okResponse)
+	http.MakeRequestAndExpectEventuallyConsistentResponse(t, suite.RoundTripper, suite.TimeoutConfig, gwAddr, okResponse)
 
 	limitResponse := http.ExpectedResponse{
 		Request: http.Request{
@@ -252,9 +271,11 @@ func runAllTrafficRateLimitTest(t *testing.T, suite *suite.ConformanceTestSuite,
 			RatelimitLimitHeaderName:     "3",
 			RatelimitRemainingHeaderName: "0", // at the end the remaining should be 0
 		}
+	} else {
+		limitResponse.Response.AbsentHeaders = allRateLimitHeaders
 	}
 	// this request should be limited at the end
-	utils.MakeRequestAndExpectEventuallyConsistentResponse(t, suite, gwAddr, limitResponse)
+	http.MakeRequestAndExpectEventuallyConsistentResponse(t, suite.RoundTripper, suite.TimeoutConfig, gwAddr, limitResponse)
 }
 
 func runHeaderInvertMatchRateLimitTest(t *testing.T, suite *suite.ConformanceTestSuite, disableHeader bool) {
@@ -287,10 +308,11 @@ func runHeaderInvertMatchRateLimitTest(t *testing.T, suite *suite.ConformanceTes
 	if !disableHeader {
 		okResponse.Response.Headers = map[string]string{
 			RatelimitLimitHeaderName:     "3",
-			RatelimitRemainingHeaderName: "", // empty string means we don't care about the value
+			RatelimitRemainingHeaderName: "1",
+			RatelimitResetHeaderName:     "0",
 		}
 	}
-	utils.MakeRequestAndExpectEventuallyConsistentResponse(t, suite, gwAddr, okResponse)
+	http.MakeRequestAndExpectEventuallyConsistentResponse(t, suite.RoundTripper, suite.TimeoutConfig, gwAddr, okResponse)
 
 	// this request should be limited because the user is one and org is not test and the limit is 3
 	limitResponse := http.ExpectedResponse{
@@ -302,10 +324,6 @@ func runHeaderInvertMatchRateLimitTest(t *testing.T, suite *suite.ConformanceTes
 			},
 		},
 		Response: http.Response{
-			Headers: map[string]string{
-				RatelimitLimitHeaderName:     "3",
-				RatelimitRemainingHeaderName: "0", // at the end the remaining should be 0
-			},
 			StatusCode: 429,
 		},
 		Namespace: ns,
@@ -313,10 +331,12 @@ func runHeaderInvertMatchRateLimitTest(t *testing.T, suite *suite.ConformanceTes
 	if !disableHeader {
 		limitResponse.Response.Headers = map[string]string{
 			RatelimitLimitHeaderName:     "3",
-			RatelimitRemainingHeaderName: "0", // empty string means we don't care about the value
+			RatelimitRemainingHeaderName: "0",
 		}
+	} else {
+		limitResponse.Response.AbsentHeaders = allRateLimitHeaders
 	}
-	utils.MakeRequestAndExpectEventuallyConsistentResponse(t, suite, gwAddr, limitResponse)
+	http.MakeRequestAndExpectEventuallyConsistentResponse(t, suite.RoundTripper, suite.TimeoutConfig, gwAddr, limitResponse)
 
 	// with test org
 	testOrgResponse := http.ExpectedResponse{
@@ -334,9 +354,11 @@ func runHeaderInvertMatchRateLimitTest(t *testing.T, suite *suite.ConformanceTes
 	}
 	if !disableHeader {
 		testOrgResponse.Response.Headers = map[string]string{
-			RatelimitLimitHeaderName:     "", // we don't care the real number
-			RatelimitRemainingHeaderName: "",
+			RatelimitLimitHeaderName: "4294967295",
+			RatelimitResetHeaderName: "0",
 		}
+	} else {
+		testOrgResponse.Response.AbsentHeaders = allRateLimitHeaders
 	}
-	utils.MakeRequestAndExpectEventuallyConsistentResponse(t, suite, gwAddr, testOrgResponse)
+	http.MakeRequestAndExpectEventuallyConsistentResponse(t, suite.RoundTripper, suite.TimeoutConfig, gwAddr, testOrgResponse)
 }
diff --git a/test/e2e/tests/local_ratelimit_distinct_cidr.go b/test/e2e/tests/local_ratelimit_distinct_cidr.go
index 2b943e5e1..8f7ab61b0 100644
--- a/test/e2e/tests/local_ratelimit_distinct_cidr.go
+++ b/test/e2e/tests/local_ratelimit_distinct_cidr.go
@@ -19,7 +19,6 @@ import (
 
 	"github.com/envoyproxy/gateway/internal/gatewayapi"
 	"github.com/envoyproxy/gateway/internal/gatewayapi/resource"
-	"github.com/envoyproxy/gateway/test/e2e/utils"
 )
 
 func init() {
@@ -100,7 +99,7 @@ var LocalRateLimitDistinctCIDRTest = suite.ConformanceTest{
 }
 
 func testRatelimit(t *testing.T, suite *suite.ConformanceTestSuite, headers map[string]string, ns, gwAddr, path string) {
-	utils.MakeRequestAndExpectEventuallyConsistentResponse(t, suite, gwAddr, http.ExpectedResponse{
+	http.MakeRequestAndExpectEventuallyConsistentResponse(t, suite.RoundTripper, suite.TimeoutConfig, gwAddr, http.ExpectedResponse{
 		Request: http.Request{
 			Path:    path,
 			Headers: headers,
@@ -115,7 +114,7 @@ func testRatelimit(t *testing.T, suite *suite.ConformanceTestSuite, headers map[
 			StatusCode: 200,
 			Headers: map[string]string{
 				RatelimitLimitHeaderName:     "3",
-				RatelimitRemainingHeaderName: "", // empty string means we don't care about the value
+				RatelimitRemainingHeaderName: "1",
 			},
 		},
 		Namespace: ns,
diff --git a/test/e2e/utils/http.go b/test/e2e/utils/http.go
index 41338f58c..3158761f1 100644
--- a/test/e2e/utils/http.go
+++ b/test/e2e/utils/http.go
@@ -8,46 +8,16 @@
 package utils
 
 import (
-	"fmt"
-	"strings"
 	"testing"
-	"time"
 
 	"github.com/stretchr/testify/require"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/types"
 	gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
-	"sigs.k8s.io/gateway-api/conformance/utils/http"
 	"sigs.k8s.io/gateway-api/conformance/utils/kubernetes"
-	"sigs.k8s.io/gateway-api/conformance/utils/roundtripper"
 	"sigs.k8s.io/gateway-api/conformance/utils/suite"
-	"sigs.k8s.io/gateway-api/conformance/utils/tlog"
 )
 
-// MakeRequestAndExpectEventuallyConsistentResponse sends a request to the gateway and waits for an eventually consistent response.
-// This's a fork of upstream unless https://github.com/kubernetes-sigs/gateway-api/issues/3794 fixed.
-func MakeRequestAndExpectEventuallyConsistentResponse(t *testing.T, suite *suite.ConformanceTestSuite, gwAddr string, expected http.ExpectedResponse) {
-	t.Helper()
-
-	req := http.MakeRequest(t, &expected, gwAddr, "HTTP", "http")
-
-	http.AwaitConvergence(t, suite.TimeoutConfig.RequiredConsecutiveSuccesses, suite.TimeoutConfig.MaxTimeToConsistency, func(elapsed time.Duration) bool {
-		cReq, cRes, err := suite.RoundTripper.CaptureRoundTrip(req)
-		if err != nil {
-			tlog.Logf(t, "Request failed, not ready yet: %v (after %v)", err.Error(), elapsed)
-			return false
-		}
-
-		if err := compareRequest(t, &req, cReq, cRes, expected); err != nil {
-			tlog.Logf(t, "Response expectation failed for request: %+v  not ready yet: %v (after %v)", req, err, elapsed)
-			return false
-		}
-
-		return true
-	})
-	tlog.Logf(t, "Request passed")
-}
-
 // GatewaysMustBeAccepted waits for the Gateways to be accepted and returns the address of the Gateways.
 // This is used when a HTTPRoute referenced by multiple Gateways.
 // Warning: we didn't check the status of HTTPRoute.
@@ -83,170 +53,3 @@ func GatewaysMustBeAccepted(t *testing.T, suite *suite.ConformanceTestSuite, gwR
 
 	return gwAddress
 }
-
-func compareRequest(t *testing.T, req *roundtripper.Request, cReq *roundtripper.CapturedRequest, cRes *roundtripper.CapturedResponse, expected http.ExpectedResponse) error {
-	if roundtripper.IsTimeoutError(cRes.StatusCode) {
-		if roundtripper.IsTimeoutError(expected.Response.StatusCode) {
-			return nil
-		}
-	}
-	if expected.Response.StatusCode != cRes.StatusCode {
-		return fmt.Errorf("expected status code to be %d, got %d", expected.Response.StatusCode, cRes.StatusCode)
-	}
-	if cRes.StatusCode == 200 {
-		// The request expected to arrive at the backend is
-		// the same as the request made, unless otherwise
-		// specified.
-		if expected.ExpectedRequest == nil {
-			expected.ExpectedRequest = &http.ExpectedRequest{Request: expected.Request}
-		}
-
-		if expected.ExpectedRequest.Method == "" {
-			expected.ExpectedRequest.Method = "GET"
-		}
-
-		if expected.ExpectedRequest.Host != "" && expected.ExpectedRequest.Host != cReq.Host {
-			return fmt.Errorf("expected host to be %s, got %s", expected.ExpectedRequest.Host, cReq.Host)
-		}
-
-		if expected.ExpectedRequest.Path != cReq.Path {
-			return fmt.Errorf("expected path to be %s, got %s", expected.ExpectedRequest.Path, cReq.Path)
-		}
-		if expected.ExpectedRequest.Method != cReq.Method {
-			return fmt.Errorf("expected method to be %s, got %s", expected.ExpectedRequest.Method, cReq.Method)
-		}
-		if expected.Namespace != cReq.Namespace {
-			return fmt.Errorf("expected namespace to be %s, got %s", expected.Namespace, cReq.Namespace)
-		}
-		if expected.ExpectedRequest.Headers != nil {
-			if cReq.Headers == nil {
-				return fmt.Errorf("no headers captured, expected %v", len(expected.ExpectedRequest.Headers))
-			}
-			for name, val := range cReq.Headers {
-				cReq.Headers[strings.ToLower(name)] = val
-			}
-			for name, expectedVal := range expected.ExpectedRequest.Headers {
-				actualVal, ok := cReq.Headers[strings.ToLower(name)]
-				if !ok {
-					return fmt.Errorf("expected %s header to be set, actual headers: %v", name, cReq.Headers)
-				} else if strings.Join(actualVal, ",") != expectedVal {
-					return fmt.Errorf("expected %s header to be set to %s, got %s", name, expectedVal, strings.Join(actualVal, ","))
-				}
-			}
-		}
-
-		if expected.Response.Headers != nil {
-			if cRes.Headers == nil {
-				return fmt.Errorf("no headers captured, expected %v", len(expected.ExpectedRequest.Headers))
-			}
-			for name, val := range cRes.Headers {
-				cRes.Headers[strings.ToLower(name)] = val
-			}
-
-			for name, expectedVal := range expected.Response.Headers {
-				actualVal, ok := cRes.Headers[strings.ToLower(name)]
-				if !ok {
-					return fmt.Errorf("expected %s header to be set, actual headers: %v", name, cRes.Headers)
-				}
-
-				if expectedVal == "" {
-					// If the expected value is empty, we don't care about the actual value.
-					// This is useful for headers that are set by the backend, and we don't
-					// care about their values.
-					continue
-				}
-
-				if strings.Join(actualVal, ",") != expectedVal {
-					return fmt.Errorf("expected %s header to be set to %s, got %s", name, expectedVal, strings.Join(actualVal, ","))
-				}
-			}
-		}
-
-		if len(expected.Response.AbsentHeaders) > 0 {
-			for name, val := range cRes.Headers {
-				cRes.Headers[strings.ToLower(name)] = val
-			}
-
-			for _, name := range expected.Response.AbsentHeaders {
-				val, ok := cRes.Headers[strings.ToLower(name)]
-				if ok {
-					return fmt.Errorf("expected %s header to not be set, got %s", name, val)
-				}
-			}
-		}
-
-		// Verify that headers expected *not* to be present on the
-		// request are actually not present.
-		if len(expected.ExpectedRequest.AbsentHeaders) > 0 {
-			for name, val := range cReq.Headers {
-				cReq.Headers[strings.ToLower(name)] = val
-			}
-
-			for _, name := range expected.ExpectedRequest.AbsentHeaders {
-				val, ok := cReq.Headers[strings.ToLower(name)]
-				if ok {
-					return fmt.Errorf("expected %s header to not be set, got %s", name, val)
-				}
-			}
-		}
-
-		if !strings.HasPrefix(cReq.Pod, expected.Backend) {
-			return fmt.Errorf("expected pod name to start with %s, got %s", expected.Backend, cReq.Pod)
-		}
-	} else if roundtripper.IsRedirect(cRes.StatusCode) {
-		if expected.RedirectRequest == nil {
-			return nil
-		}
-
-		setRedirectRequestDefaults(req, cRes, &expected)
-
-		if expected.RedirectRequest.Host != cRes.RedirectRequest.Host {
-			return fmt.Errorf("expected redirected hostname to be %q, got %q", expected.RedirectRequest.Host, cRes.RedirectRequest.Host)
-		}
-
-		gotPort := cRes.RedirectRequest.Port
-		if expected.RedirectRequest.Port == "" {
-			// If the test didn't specify any expected redirect port, we'll try to use
-			// the scheme to determine sensible defaults for the port. Well known
-			// schemes like "http" and "https" MAY skip setting any port.
-			if strings.ToLower(cRes.RedirectRequest.Scheme) == "http" && gotPort != "80" && gotPort != "" {
-				return fmt.Errorf("for http scheme, expected redirected port to be 80 or not set, got %q", gotPort)
-			}
-			if strings.ToLower(cRes.RedirectRequest.Scheme) == "https" && gotPort != "443" && gotPort != "" {
-				return fmt.Errorf("for https scheme, expected redirected port to be 443 or not set, got %q", gotPort)
-			}
-			if strings.ToLower(cRes.RedirectRequest.Scheme) != "http" || strings.ToLower(cRes.RedirectRequest.Scheme) != "https" {
-				tlog.Logf(t, "Can't validate redirectPort for unrecognized scheme %v", cRes.RedirectRequest.Scheme)
-			}
-		} else if expected.RedirectRequest.Port != gotPort {
-			// An expected port was specified in the tests but it didn't match with
-			// gotPort.
-			return fmt.Errorf("expected redirected port to be %q, got %q", expected.RedirectRequest.Port, gotPort)
-		}
-
-		if expected.RedirectRequest.Scheme != cRes.RedirectRequest.Scheme {
-			return fmt.Errorf("expected redirected scheme to be %q, got %q", expected.RedirectRequest.Scheme, cRes.RedirectRequest.Scheme)
-		}
-
-		if expected.RedirectRequest.Path != cRes.RedirectRequest.Path {
-			return fmt.Errorf("expected redirected path to be %q, got %q", expected.RedirectRequest.Path, cRes.RedirectRequest.Path)
-		}
-	}
-	return nil
-}
-
-func setRedirectRequestDefaults(req *roundtripper.Request, cRes *roundtripper.CapturedResponse, expected *http.ExpectedResponse) {
-	// If the expected host is nil it means we do not test host redirect.
-	// In that case we are setting it to the one we got from the response because we do not know the ip/host of the gateway.
-	if expected.RedirectRequest.Host == "" {
-		expected.RedirectRequest.Host = cRes.RedirectRequest.Host
-	}
-
-	if expected.RedirectRequest.Scheme == "" {
-		expected.RedirectRequest.Scheme = req.URL.Scheme
-	}
-
-	if expected.RedirectRequest.Path == "" {
-		expected.RedirectRequest.Path = req.URL.Path
-	}
-}
diff --git a/test/helm/gateway-crds-helm/all.out.yaml b/test/helm/gateway-crds-helm/all.out.yaml
index 114df2f1d..15562aa62 100644
--- a/test/helm/gateway-crds-helm/all.out.yaml
+++ b/test/helm/gateway-crds-helm/all.out.yaml
@@ -17951,6 +17951,14 @@ spec:
                               minimum: 100
                               type: integer
                             type: array
+                          hostname:
+                            description: |-
+                              Hostname defines the HTTP host that will be requested during health checking.
+                              Default: HTTPRoute or GRPCRoute hostname.
+                            maxLength: 253
+                            minLength: 1
+                            pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                            type: string
                           method:
                             description: |-
                               Method defines the HTTP method used for health checking.
@@ -21430,6 +21438,14 @@ spec:
                                         minimum: 100
                                         type: integer
                                       type: array
+                                    hostname:
+                                      description: |-
+                                        Hostname defines the HTTP host that will be requested during health checking.
+                                        Default: HTTPRoute or GRPCRoute hostname.
+                                      maxLength: 253
+                                      minLength: 1
+                                      pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                      type: string
                                     method:
                                       description: |-
                                         Method defines the HTTP method used for health checking.
@@ -34304,6 +34320,14 @@ spec:
                                                           minimum: 100
                                                           type: integer
                                                         type: array
+                                                      hostname:
+                                                        description: |-
+                                                          Hostname defines the HTTP host that will be requested during health checking.
+                                                          Default: HTTPRoute or GRPCRoute hostname.
+                                                        maxLength: 253
+                                                        minLength: 1
+                                                        pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                                        type: string
                                                       method:
                                                         description: |-
                                                           Method defines the HTTP method used for health checking.
@@ -35323,6 +35347,14 @@ spec:
                                                           minimum: 100
                                                           type: integer
                                                         type: array
+                                                      hostname:
+                                                        description: |-
+                                                          Hostname defines the HTTP host that will be requested during health checking.
+                                                          Default: HTTPRoute or GRPCRoute hostname.
+                                                        maxLength: 253
+                                                        minLength: 1
+                                                        pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                                        type: string
                                                       method:
                                                         description: |-
                                                           Method defines the HTTP method used for health checking.
@@ -36431,6 +36463,14 @@ spec:
                                                     minimum: 100
                                                     type: integer
                                                   type: array
+                                                hostname:
+                                                  description: |-
+                                                    Hostname defines the HTTP host that will be requested during health checking.
+                                                    Default: HTTPRoute or GRPCRoute hostname.
+                                                  maxLength: 253
+                                                  minLength: 1
+                                                  pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                                  type: string
                                                 method:
                                                   description: |-
                                                     Method defines the HTTP method used for health checking.
@@ -37456,6 +37496,14 @@ spec:
                                               minimum: 100
                                               type: integer
                                             type: array
+                                          hostname:
+                                            description: |-
+                                              Hostname defines the HTTP host that will be requested during health checking.
+                                              Default: HTTPRoute or GRPCRoute hostname.
+                                            maxLength: 253
+                                            minLength: 1
+                                            pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                            type: string
                                           method:
                                             description: |-
                                               Method defines the HTTP method used for health checking.
@@ -39302,6 +39350,14 @@ spec:
                                           minimum: 100
                                           type: integer
                                         type: array
+                                      hostname:
+                                        description: |-
+                                          Hostname defines the HTTP host that will be requested during health checking.
+                                          Default: HTTPRoute or GRPCRoute hostname.
+                                        maxLength: 253
+                                        minLength: 1
+                                        pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                        type: string
                                       method:
                                         description: |-
                                           Method defines the HTTP method used for health checking.
@@ -40219,6 +40275,14 @@ spec:
                                           minimum: 100
                                           type: integer
                                         type: array
+                                      hostname:
+                                        description: |-
+                                          Hostname defines the HTTP host that will be requested during health checking.
+                                          Default: HTTPRoute or GRPCRoute hostname.
+                                        maxLength: 253
+                                        minLength: 1
+                                        pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                        type: string
                                       method:
                                         description: |-
                                           Method defines the HTTP method used for health checking.
@@ -41331,6 +41395,14 @@ spec:
                                                 minimum: 100
                                                 type: integer
                                               type: array
+                                            hostname:
+                                              description: |-
+                                                Hostname defines the HTTP host that will be requested during health checking.
+                                                Default: HTTPRoute or GRPCRoute hostname.
+                                              maxLength: 253
+                                              minLength: 1
+                                              pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                              type: string
                                             method:
                                               description: |-
                                                 Method defines the HTTP method used for health checking.
@@ -42438,6 +42510,14 @@ spec:
                                           minimum: 100
                                           type: integer
                                         type: array
+                                      hostname:
+                                        description: |-
+                                          Hostname defines the HTTP host that will be requested during health checking.
+                                          Default: HTTPRoute or GRPCRoute hostname.
+                                        maxLength: 253
+                                        minLength: 1
+                                        pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                        type: string
                                       method:
                                         description: |-
                                           Method defines the HTTP method used for health checking.
diff --git a/test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml b/test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml
index adfb9237a..98ce60dc8 100644
--- a/test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml
+++ b/test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml
@@ -639,6 +639,14 @@ spec:
                               minimum: 100
                               type: integer
                             type: array
+                          hostname:
+                            description: |-
+                              Hostname defines the HTTP host that will be requested during health checking.
+                              Default: HTTPRoute or GRPCRoute hostname.
+                            maxLength: 253
+                            minLength: 1
+                            pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                            type: string
                           method:
                             description: |-
                               Method defines the HTTP method used for health checking.
@@ -4118,6 +4126,14 @@ spec:
                                         minimum: 100
                                         type: integer
                                       type: array
+                                    hostname:
+                                      description: |-
+                                        Hostname defines the HTTP host that will be requested during health checking.
+                                        Default: HTTPRoute or GRPCRoute hostname.
+                                      maxLength: 253
+                                      minLength: 1
+                                      pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                      type: string
                                     method:
                                       description: |-
                                         Method defines the HTTP method used for health checking.
@@ -16992,6 +17008,14 @@ spec:
                                                           minimum: 100
                                                           type: integer
                                                         type: array
+                                                      hostname:
+                                                        description: |-
+                                                          Hostname defines the HTTP host that will be requested during health checking.
+                                                          Default: HTTPRoute or GRPCRoute hostname.
+                                                        maxLength: 253
+                                                        minLength: 1
+                                                        pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                                        type: string
                                                       method:
                                                         description: |-
                                                           Method defines the HTTP method used for health checking.
@@ -18011,6 +18035,14 @@ spec:
                                                           minimum: 100
                                                           type: integer
                                                         type: array
+                                                      hostname:
+                                                        description: |-
+                                                          Hostname defines the HTTP host that will be requested during health checking.
+                                                          Default: HTTPRoute or GRPCRoute hostname.
+                                                        maxLength: 253
+                                                        minLength: 1
+                                                        pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                                        type: string
                                                       method:
                                                         description: |-
                                                           Method defines the HTTP method used for health checking.
@@ -19119,6 +19151,14 @@ spec:
                                                     minimum: 100
                                                     type: integer
                                                   type: array
+                                                hostname:
+                                                  description: |-
+                                                    Hostname defines the HTTP host that will be requested during health checking.
+                                                    Default: HTTPRoute or GRPCRoute hostname.
+                                                  maxLength: 253
+                                                  minLength: 1
+                                                  pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                                  type: string
                                                 method:
                                                   description: |-
                                                     Method defines the HTTP method used for health checking.
@@ -20144,6 +20184,14 @@ spec:
                                               minimum: 100
                                               type: integer
                                             type: array
+                                          hostname:
+                                            description: |-
+                                              Hostname defines the HTTP host that will be requested during health checking.
+                                              Default: HTTPRoute or GRPCRoute hostname.
+                                            maxLength: 253
+                                            minLength: 1
+                                            pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                            type: string
                                           method:
                                             description: |-
                                               Method defines the HTTP method used for health checking.
@@ -21990,6 +22038,14 @@ spec:
                                           minimum: 100
                                           type: integer
                                         type: array
+                                      hostname:
+                                        description: |-
+                                          Hostname defines the HTTP host that will be requested during health checking.
+                                          Default: HTTPRoute or GRPCRoute hostname.
+                                        maxLength: 253
+                                        minLength: 1
+                                        pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                        type: string
                                       method:
                                         description: |-
                                           Method defines the HTTP method used for health checking.
@@ -22907,6 +22963,14 @@ spec:
                                           minimum: 100
                                           type: integer
                                         type: array
+                                      hostname:
+                                        description: |-
+                                          Hostname defines the HTTP host that will be requested during health checking.
+                                          Default: HTTPRoute or GRPCRoute hostname.
+                                        maxLength: 253
+                                        minLength: 1
+                                        pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                        type: string
                                       method:
                                         description: |-
                                           Method defines the HTTP method used for health checking.
@@ -24019,6 +24083,14 @@ spec:
                                                 minimum: 100
                                                 type: integer
                                               type: array
+                                            hostname:
+                                              description: |-
+                                                Hostname defines the HTTP host that will be requested during health checking.
+                                                Default: HTTPRoute or GRPCRoute hostname.
+                                              maxLength: 253
+                                              minLength: 1
+                                              pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                              type: string
                                             method:
                                               description: |-
                                                 Method defines the HTTP method used for health checking.
@@ -25126,6 +25198,14 @@ spec:
                                           minimum: 100
                                           type: integer
                                         type: array
+                                      hostname:
+                                        description: |-
+                                          Hostname defines the HTTP host that will be requested during health checking.
+                                          Default: HTTPRoute or GRPCRoute hostname.
+                                        maxLength: 253
+                                        minLength: 1
+                                        pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                        type: string
                                       method:
                                         description: |-
                                           Method defines the HTTP method used for health checking.